CVE-2026-90989

Deferred Deferred - Pending Action

Unauthenticated Access to Staff Email Addresses in Tainacan WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: WPScan

Description

The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-90989

EUVD

EUVD-2026-100861

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Tainacan	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

The Tainacan WordPress plugin before version 1.4.0 has a vulnerability where its reports REST endpoints do not restrict access to users with management capabilities. This allows any authenticated subscriber to read the email addresses of the repository's staff.

Detection Guidance

Check WordPress plugin versions using WPScan or similar tools to identify if Tainacan plugin is below 1.4.0. Inspect REST API endpoints for reports to see if unauthorized users can access staff email data.

Impact Analysis

An attacker with subscriber access could exploit this to obtain staff email addresses, potentially leading to phishing attacks or unauthorized access to sensitive information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA due to unauthorized exposure of personal data, such as email addresses, which may be considered sensitive information under these regulations.

Mitigation Strategies

Immediately update the Tainacan plugin to version 1.4.0 or later. Ensure all users have appropriate capability levels and restrict access to sensitive REST endpoints.

Hi! I’m here to help you understand CVE-2026-90989. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70