CVE-2026-6230

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-6230

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6230.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-6230

Published

2026-07-08T11:30:32Z

Modified

2026-08-12T03:51:09Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

Details

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Database specific

{
    "cna_assigner": "Wordfence",
    "cwe_ids": [
        "CWE-89"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6230.json"
}

References

Affected packages

Git / github.com/tainacan/tainacan

Affected ranges

Type

GIT

Repo

https://github.com/tainacan/tainacan

Events

Introduced

Fixed

579d28d7752b27ed3407f5197abb6349b3efc3c9

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.1

0.11

0.3

0.7

Other

security-adjustment

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6230.json"