PT-2025-52573 · WordPress · Tainacan

Deadbee · Published 2025-12-21 · Updated 2025-12-21 · CVE-2025-14043

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Tainacan plugin for WordPress versions up to and including 1.0.1

Description The Tainacan plugin for WordPress has a flaw where unauthorized metadata sections can be created. This is because the create item permissions check() function always returns true, bypassing necessary authentication and authorization checks. This allows unauthenticated attackers to create arbitrary metadata sections for any collection through the public REST API, provided they have access to the WordPress site.

Recommendations Update the Tainacan plugin to a version beyond 1.0.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14043

Affected Products

Tainacan

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14043 · Security Note
• https://plugins.trac.wordpress.org/browser/tainacan/trunk/classes/api/endpoints/class-tainacan-rest-metadata-sections-controller.php#L363 · Note
• https://t.me/cveNotify/146457 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2002586566967906598 · Twitter Post
• https://twitter.com/CVEnew/status/2002835933154922559 · Twitter Post
• https://t.me/CVEtracker/40356 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/5596a0f0-6bfe-4c6e-a0d6-117e13117098?source=cve · Note
• https://plugins.trac.wordpress.org/browser/tainacan/tags/1.0.1/classes/api/endpoints/class-tainacan-rest-metadata-sections-controller.php#L363 · Note