CVE-2026-95590

Executive Summary

CVE-2026-95590 is a SQL injection vulnerability in the Tainacan WordPress plugin affecting versions up to and including 1.2.0. The flaw resides in the "Subscriber" context, meaning an authenticated user with the low-privileged Subscriber role can inject SQL through an unspecified vulnerable parameter. Successful exploitation permits high-confidentiality database exfiltration and a limited availability impact, though the elevated attack complexity and required authentication reduce the practical attack surface.

Technical Analysis

The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The NVD description states the issue is a "Subscriber SQL Injection in Tainacan <= 1.2.0 versions." This phrasing indicates the injection point is reachable by an authenticated user holding the Subscriber role—the lowest tier of the standard WordPress role hierarchy, typically granted to registered readers who have no publishing or administrative capabilities.

The CVSS v3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L) provides several meaningful constraints on the nature of the flaw. The network attack vector (AV:N) confirms the vulnerable component is remotely reachable, consistent with a web-facing WordPress plugin endpoint. The high attack complexity (AC:H) suggests that successful exploitation depends on conditions outside the attacker's direct control—for example, specific database versions, query construction prerequisites, or race/timing considerations. The low privileges required (PR:L) align with the Subscriber role requirement. No user interaction is needed (UI:N), and the scope is changed (S:C), indicating that a compromise of the vulnerable plugin component can affect resources beyond its original security scope—typically the broader WordPress database and hosting environment.

Confidentiality impact is rated High (C:H), which is the primary risk driver: an attacker can read arbitrary data from the underlying database, potentially including user password hashes, session tokens, private content, and configuration secrets stored in WordPress tables. Integrity impact is absent (I:N) in the vector, and availability is Low (A:L), suggesting the injection is primarily read-oriented (e.g., UNION-based or boolean/error-based extraction) rather than one permitting wholesale data modification or destructive queries.

The exact vulnerable parameter, function name, and injection point are not disclosed in the available NVD description. No CVE-specific technical writeup, patch diff, or source-code reference is available in the provided data, so the precise query construction that permits injection cannot be stated without speculation. What can be established from the data is the vulnerability class (SQL injection), the privilege level required (Subscriber), the affected product and version ceiling (Tainacan <= 1.2.0), and the resulting confidentiality-focused impact profile.

At the class level, Subscriber-reachable SQL injection in WordPress plugins typically occurs when a plugin registers an AJAX action, REST route, or shortcode handler that accepts user-supplied input and concatenates it into a SQL statement without parameterization, or without adequately applying WordPress's $wpdb->prepare() abstraction. Because the endpoint only verifies that the user is logged in—rather than enforcing a capability check appropriate to the operation—any authenticated account, including a self-registered Subscriber, can reach the query. This is consistent with the PR:L rating. The AC:H rating suggests the injection may require the attacker to supply a crafted value that survives sanitization or matches an expected data format before reaching the sink.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-95590. The attack chain described below is inferred strictly from the vulnerability class (CWE-89) and the metadata provided; it does not reference any specific parameter, function, or endpoint, because none are disclosed in the source data.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running the Tainacan plugin at a version at or below 1.2.0. Tainacan is a digital repository/collections plugin, so targets are likely institutions, museums, archives, universities, and cultural-heritage organizations that expose a public-facing repository. Fingerprinting can be performed via plugin asset paths and page markers associated with Tainacan.

2. Privilege acquisition. Because the vulnerability requires the Subscriber role (PR:L), the attacker must first obtain an authenticated low-privileged account. On sites permitting open registration, this may be as simple as self-registering. On closed sites, the attacker would need stolen Subscriber credentials obtained through phishing, credential stuffing, or prior compromise. This requirement is the principal barrier to exploitation.

3. Triggering the flaw (vulnerability-class level). Once authenticated, the attacker sends a crafted request to the plugin component that performs an insufficiently sanitized SQL query. The injected payload targets the vulnerable query construction—classically by appending boolean conditions, UNION SELECT clauses, or time/error-based probes—with the objective of causing the backend database to execute attacker-controlled SQL fragments alongside the intended query.

4. Payload execution and extraction. Within the SQL-injection class, a read-oriented attacker would use the injection to enumerate schemas and extract data. Because CVSS rates confidentiality as High and integrity as None, the exploitation objective consistent with this profile is database read-out: WordPress user tables (password hashes, emails), plugin-specific repository data, and any secrets stored in the database.

5. Post-exploitation impact. The scope change (S:C) means extracted data can include material beyond the plugin's own tables, potentially enabling lateral movement—such as cracking WordPress password hashes to escalate to Administrator, harvesting session data, or exfiltrating sensitive institutional content held in the Tainacan repository. The Low availability rating suggests limited or incidental disruption rather than deliberate destruction.

Because no exploit is public and no technical detail beyond the class is available, defenders should treat the exact request shape as unknown and rely on generic SQL-injection detection (see Detection Guidance) rather than signature matching against a known payload.

Impact Assessment

The CVSS v3.1 base score is 7.1 (High). Subscore analysis:

• Attack Vector (Network): The vulnerable component is remotely reachable over the web.
• Attack Complexity (High): Exploitation depends on conditions the attacker cannot fully control, lowering the likelihood of a trivial, single-request compromise.
• Privileges Required (Low): An authenticated Subscriber account is sufficient, meaning the barrier is authentication rather than capability. Open-registration sites are materially more exposed.
• User Interaction (None): No victim action is needed beyond the attacker's own authenticated session.
• Scope (Changed): The compromise can affect components beyond the vulnerable plugin, amplifying impact.
• Confidentiality (High): The dominant impact—arbitrary database reads.
• Integrity (None) / Availability (Low): No direct data modification; minor availability effect.

Business impact. Affected organizations are those running Tainacan—predominantly cultural, academic, and public-sector repositories where data sensitivity may include contributor personal information, unpublished archival material, and administrative credentials. A successful read-oriented injection can expose user credential hashes, enabling account takeover and privilege escalation to administrative roles, and can disclose the repository's underlying data. Because scope is changed, the blast radius may extend beyond the plugin to the entire WordPress installation and any co-hosted databases.

Blast radius. Any WordPress installation with Tainacan <= 1.2.0 that permits low-privileged authenticated access is in scope. The EPSS score has not been assigned by FIRST.org, and CISA KEV does not list this CVE, indicating no confirmed exploitation in the wild as of the data provided. This should not be read as a guarantee of safety—absence from KEV reflects confirmed exploitation, not absence of risk.

Detection Guidance

Sigma Rule

title: Potential SQL Injection Attempt Against Tainacan Plugin (Subscriber Context)
id: 4b8f1c2e-9a7d-4f3b-b6e1-tainacan95590
status: experimental
description: Detects SQL injection patterns in HTTP requests targeting WordPress sites running the Tainacan plugin, consistent with CVE-2026-95590 (Subscriber SQL injection).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-95590
author: Valters IT Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_sqli:
    c-uri|contains:
      - 'UNION SELECT'
      - 'union select'
      - 'information_schema'
      - 'SLEEP('
      - 'BENCHMARK('
      - "' OR '1'='1"
      - 'CONCAT('
      - '-- -'
  condition: selection_method and selection_sqli
falsepositives:
  - Legitimate application traffic containing SQL keywords in free-text fields
  - Security scanners
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.95590

YARA Rule

rule CVE_2026_95590_Tainacan_SQLi_HTTP
{
    meta:
        description = "Detects SQL injection payloads in HTTP request traffic targeting Tainacan plugin installations (CVE-2026-95590)"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-95590"
        date = "2026-01-01"
        severity = "high"

    strings:
        $sqli1 = "UNION SELECT" nocase
        $sqli2 = "information_schema" nocase
        $sqli3 = "SLEEP(" nocase
        $sqli4 = "BENCHMARK(" nocase
        $sqli5 = "CONCAT(" nocase
        $sqli6 = "' OR '1'='1" nocase
        $comment = "--" nocase

    condition:
        any of ($sqli1, $sqli2, $sqli3, $sqli4, $sqli5, $sqli6) or
        (2 of ($sqli*) and $comment)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-95590 Tainacan Plugin SQL Injection Attempt"; flow:established,to_server; http.method; content:"GET" or content:"POST"; http.uri; content:"tainacan"; nocase; http.uri; content:"UNION"; nocase; http.uri; content:"SELECT"; nocase; distance:0; classtype:web-application-attack; reference:cve,2026-95590; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-95590; sid:2026955900; rev:1;)

alert http any any -> any any (msg:"CVE-2026-95590 Tainacan SQLi Boolean/Time Based Pattern"; flow:established,to_server; http.uri; content:"tainacan"; nocase; http.uri; pcre:"/(SLEEP|BENCHMARK|information_schema|%27%20OR%20%271%27%3D%271)/i"; classtype:web-application-attack; reference:cve,2026-95590; sid:2026955901; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where network.protocol == "http" and
      http.request.method in ("GET", "POST") and
      stringContains(url.path, "tainacan") ]
  [ network where network.protocol == "http" and
      (stringContains(url.query, "UNION SELECT") or
       stringContains(url.query, "information_schema") or
       stringContains(url.query, "SLEEP(") or
       stringContains(url.query, "BENCHMARK(") or
       stringContains(url.query, "' OR '1'='1")) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:access
| eval uri_lower = lower(uri)
| where (like(uri_lower, "%tainacan%"))
| where (like(uri_lower, "%union%select%")
    OR like(uri_lower, "%information_schema%")
    OR like(uri_lower, "%sleep(%")
    OR like(uri_lower, "%benchmark(%")
    OR like(uri_lower, "%concat(%")
    OR like(uri_lower, "%' or '1'='1%"))
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri) as targeted_uris
        by src_ip, host, status
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,sqli,">
  <rule id="100955" level="12">
    <if_sid>31100,31101,31103,31104,31106</if_sid>
    <url>/tainacan</url>
    <regex type="pcre2">(?i)(union[\s\+]+select|information_schema|sleep\(|benchmark\(|'[\s\+]*or[\s\+]*'1'[\s\+]*=[\s\+]*'1)</regex>
    <description>CVE-2026-95590: Possible SQL injection attempt against Tainacan plugin (Subscriber SQLi)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_95590,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround is available from any tracked source, and no fixed version has been published. The following guidance is therefore defensive and compensating rather than corrective.

1) Immediate mitigations (reduce reachability of the vulnerability):

• Disable open user registration. Because exploitation requires only the Subscriber role (PR:L), preventing unauthenticated users from self-registering a Subscriber account removes the lowest-friction path to exploitation. Audit existing Subscriber accounts and remove any that are not required.
• If the repository does not need to be public, restrict access to the Tainacan plugin with network controls (IP allowlisting) or HTTP authentication at the reverse proxy/WAF layer.
• Enforce least privilege on WordPress accounts and enable strong authentication (MFA) for all accounts, so that stolen Subscriber credentials cannot be trivially reused and so that escalation following a data breach is impeded.
• Deploy a web application firewall (WAF) with generic SQL-injection rule sets. This is a compensating control, not a fix, and can be evaded; it should be combined with the controls above.
• Ensure the WordPress database user associated with the site has the minimum privileges necessary (no DROP, no FILE, no cross-database grants), limiting the scope of any successful injection.

2) Patch / upgrade steps:

• There is currently no patch or fixed version. Monitor the Tainacan project's release channel and the NVD entry (CVE-2026-95590) for a vendor fix. As soon as a patched release becomes available, upgrade immediately.
• Until a fix exists, if the plugin is not operationally required, consider deactivating it entirely to eliminate the attack surface.

3) Long-term hardening:

• Maintain a plugin inventory and subscribe to vulnerability feeds so that affected installations are identified and capped versions removed promptly.
• Adopt a policy that WordPress plugins must enforce capability-appropriate authorization, and audit plugins that accept input from low-privileged roles.
• Enable detailed web server and database audit logging, and alert on SQL-injection patterns and abnormal database read volumes (see Detection Guidance).
• Rotate any WordPress salts and administrative credentials, and monitor for post-exploitation signs (unexpected admin accounts, database export activity) should an injection be suspected.

References

• NVD — CVE-2026-95590: https://nvd.nist.gov/vuln/detail/CVE-2026-95590
• MITRE CWE-89 — Improper Neutralization of Special Elements used in an SQL Command: https://cwe.mitre.org/data/definitions/89.html
• FIRST.org CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-95590 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Tainacan project (monitor for vendor advisory and patched release): https://tainacan.org

Note: No public proof-of-concept, exploit code, Nuclei template, or confirmed exploit-in-the-wild activity is associated with CVE-2026-95590 based on the data provided. No threat actor campaign has been attributed. EPSS has not been scored by FIRST.org.