CVE-2026-90989 — Tainacan < 1.4.0 - Subscriber+ Repository Staff Email Address Disclosure via Reports REST Endpoints
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the …
Published: 2026-10-14 · CVSS: 4.3 · CVSS 3.1
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7