Improper neutralization of special elements in the Tainacan WordPress plugin results in a blind SQL injection vulnerability (CWE‑89). An attacker can inject SQL code that allows reading sensitive data, such as database credentials, user records, or stored content, without needing to trigger error messages. This can lead to a significant compromise of data confidentiality.

The vulnerability applies to the WordPress Tainacan plugin, vendor tainacan:Tainacan, affecting all installations of version 1.0.3 or earlier.

The CVSS score of 9.3 classifies this flaw as critical. Although EPSS data is not available, the lack of a KEV listing does not reduce the potential impact. Attackers can exploit the flaw via web requests to the plugin’s exposed endpoints, performing blind injection techniques (e.g., timing attacks) against a vulnerable WordPress site where Tainacan is installed. Given the severity and the possibility of arbitrary data access, the risk to affected systems is high.