The Tainacan plugin for WordPress is vulnerable to a time‑based blind SQL injection through the "geoquery" REST API parameter. By concatenating user input without proper escaping or parameterization, an attacker can append additional SQL commands to the existing query, allowing extraction of sensitive information from the database. This flaw is classified as a CWE‑89 vulnerability and can lead to complete database compromise without any authentication.

WordPress installations that have the Tainacan plugin version 1.0.3 or earlier are affected. The vulnerability exists in all releases up to and including 1.0.3, independent of the WordPress core version. Updating to a newer Tainacan release removes the vulnerable 'geoquery' handler.

The CVSS score of 7.5 indicates a high impact on confidentiality when the database is accessed by an unauthenticated attacker. The EPSS score of < 1% suggests a low overall probability of exploitation, but the publicly accessible endpoint and lack of authentication make exploitation straightforward. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is the publicly exposed "geoquery" REST API endpoint, which does not require any user authentication and directly accepts the injection payload.