The Tainacan plugin for WordPress allows authenticated users with subscriber-level or higher access to read arbitrary files from the server via the 'guid' parameter in a REST endpoint. The vulnerability stems from a directory traversal flaw that occurs when the uploads/tainacan directory is missing; in this circumstance the realpath() call fails and the containment check collapses, letting the attacker choose any file path. This can expose sensitive configuration, credentials, or user data, compromising confidentiality and potentially allowing further attacks.

This issue affects any WordPress installation running the Tainacan plugin version 1.3.0 or earlier. The flaw exists in the 'class-tainacan-rest-background-processes-controller.php' file in all releases up to 1.3.0. Systems still on these versions should be updated to avoid the flaw.

The vulnerability carries a CVSS score of 6.5, indicating a medium severity. The EPSS score is < 1%, which is a very low probability of exploitation. It is not listed in CISA KEV. Exploitation requires the attacker to have at least subscriber-level authentication, so the risk is higher for sites with loose access controls. The flaw can be triggered only if the uploads/tainacan directory is missing, reducing prevalence but making the scenario realistic when installations are misconfigured.