CVE Intelligence
Analysis AI-assisted

CVE-2026-42740: Tainacan WordPress Plugin - Blind SQL Injection

CVE-2026-42740 is a critical blind SQL injection flaw (CWE-89) in the Tainacan plugin for WordPress, as reported by Patchstack. The record lists affected versions up to and including 1.0.3 and gives a CVSS 3.1 base score of 9.3. The sources consulted show no confirmed exploitation, and the record lists no fixed version.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-42740 is a SQL injection weakness (CWE-89) in the Tainacan plugin for WordPress. The CNA, Patchstack, describes it as blind SQL injection, meaning an attacker may infer database information from application behavior rather than seeing query results directly.

Impact

  • The CVSS 3.1 vector in the record is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, with a base score of 9.3 (critical).
  • Per that vector, the record indicates high confidentiality impact, no integrity impact, low availability impact, and a changed scope, with no privileges or user interaction required over the network.
  • The SSVC data in the record rates technical impact as partial and automatable as yes.

Affected products and versions

  • Tainacan (Tainacan plugin for WordPress): versions from n/a through 1.0.3, inclusive, according to the record.
  • The record does not list vendor-published fixed versions.

Exploitation status

  • The CISA KEV catalog does not list this CVE in the record, so no active exploitation is reported by KEV.
  • No confirmed exploitation appears in the sources consulted.
  • The record reports an EPSS probability of 0.004 (percentile 0.32416) and an SSVC exploitation value of none.

Remediation and mitigation

  • The record contains no fixed version. This is unknown, not evidence that no fix exists. Check the Patchstack entry and the plugin maintainer for an updated release.
  • Until a verified fix is applied, consider disabling the Tainacan plugin if it is not essential, restricting administrative and public access where feasible, and using a web application firewall with virtual patching if available.
  • Review whether any affected site exposes Tainacan endpoints publicly and prioritize those sites.

Detection guidance

  • Review web server and application logs for unusual or malformed parameter values sent to Tainacan-related endpoints, and for error messages or response timing anomalies that may indicate database probing.
  • Monitor database logs for unexpected query patterns originating from the web application account.
  • Keep WordPress core, plugins and themes up to date and maintain an inventory of installed plugin versions.

Limitations of the available information

  • The record does not describe the vulnerable parameter, the affected endpoint, or the required authentication context beyond the CVSS vector.
  • No fixed version, vendor advisory text, or proof-of-concept details are present in the record.
  • The EPSS data and SSVC values reflect the record at the time of assembly and may change.

Frequently asked questions

What is CVE-2026-42740?

It is a critical blind SQL injection vulnerability (CWE-89) in the Tainacan plugin for WordPress, affecting versions through 1.0.3 according to the record.

Is this vulnerability being actively exploited?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

Is there a fixed version available?

The record lists no fixed version. This is unknown rather than proof that no fix exists, so check the Patchstack entry and the plugin maintainer.

What should administrators do now?

Identify sites running Tainacan up to 1.0.3, disable the plugin if it is not essential, restrict access where possible, and apply an updated release once it is verified.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.