The vulnerability resides in the Tainacan WordPress plugin – versions prior to 1.4.0 – where REST endpoints for reports expose the email addresses of repository staff members. The flaw is due to insufficient privilege checks; any authenticated user with the Subscriber role can trigger the endpoint and receive staff contact information. This leads to a direct leakage of sensitive contact data, compromising confidentiality for staff and potentially exposing them to phishing or spam.

The affected product is Tainacan, a WordPress plugin used to manage digital repositories. Stakeholders running any release before 1.4.0 are impacted. No further specific version details are provided by the CNA.

The CVSS score of 4.3 indicates medium severity, reflecting the limited scope and impact. The EPSS score is below 1 %, and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation at present. The attack vector is a straightforward authentication-based access; any logged‑in subscriber can retrieve the data without additional privileges. The impact is limited to information disclosure.