The vulnerability allows any unauthenticated user to read private files uploaded by the Tainacan WordPress plugin, because those files are stored in wp‑content without proper protection. The flaw is a direct information exposure that could reveal sensitive documents or data to unintended parties. This defect stems from an improper restriction of access to private resources, as identified by CWE‑552.

Affected systems are installations of the Tainacan plugin for WordPress, specifically all versions up to and including 1.0.0. WordPress sites that have deployed these versions and have private files uploaded via Tainacan may have exposed confidential data.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of <1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely involve the attacker simply requesting the location of a private file in the wp‑content directory, a path that is directly accessible because the plugin fails to enforce authentication checks. Therefore the threat is primarily limited to accidental or opportunistic disclosure, though the potential impact could still be significant if sensitive files are compromised.