The Tainacan plugin for WordPress contains a directory traversal vulnerability that permits authenticated users with Editor or higher privileges to read arbitrary files on the server. The flaw arises when the 'tmp_file' parameter is mass‑assigned during an import operation. The attacker‑controlled file path is later used by the plugin to open and parse the file via fopen() and fgetcsv(), returning the contents in a REST response. This enables disclosure of sensitive data such as configuration files, credentials, and other private files that the web process can access.

WordPress sites running Tainacan up to and including version 1.3.0 are affected. Any installation that has the plugin installed and maintains editors or higher roles can exploit this flaw.

The CVSS score of 4.9 indicates a medium impact, and the exploit requires authenticated access with at least Editor permissions; the attack path is limited to sites exposing the import endpoint. No public exploits have been reported, and the vulnerability is not listed in CISA's KEV. Because the principal vector is limited to authenticated users and requires specific API calls, the overall risk remains moderate, though the ability to retrieve arbitrary files is a serious data‑exposure threat.