The flaw in Tainacan arises from a missing authorization check in the REST API; the create_item_permissions_check() function always returns true, allowing any requester to create new metadata sections. This enables an attacker to add arbitrary sections to any collection without authenticating, thereby modifying the data schema used by the site. The weakness is captured by CWE-862, Unauthorized Access Through Improper Access Control.

The vulnerability affects the Tainacan plugin for WordPress in all releases up to and including version 1.0.1. Users who rely on these versions for managing collections are susceptible; newer releases are not known to be impacted.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% suggests exploitation is unlikely in the wild. The vulnerability is not listed in the CISA KEV catalog, and no publicly reported exploit is available. Attackers can trigger the issue via the public REST API, which requires no authentication credentials. While the immediate impact is limited to unauthorized data structure changes, it could undermine trust and consistency of the collection metadata in affected WordPress sites.