4.3
Medium
CVE-2026-90989 The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management…
Description
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Tainacan 1.4 | earliest → < 1.4.0 | 1.4.0 |