CVE-2025-14043
Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation
- State
- Published
- Severity
- 5.3 Medium
- Published
- Dec 21, 2025
- Updated
- Apr 8, 2026
- Reserved
- Dec 4, 2025
Description
The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. This is due to the `create_item_permissions_check()` function unconditionally returning true, which bypasses authentication and authorization validation. This makes it possible for unauthenticated attackers to create arbitrary metadata sections for any collection via the public REST API granted they can access the WordPress site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | Wordfence |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
Tainacantainacan |
|
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5596a0f0-6bfe-4c6e-a0d6-117e13117098?source=cve
- https://plugins.trac.wordpress.org/browser/tainacan/trunk/classes/api/endpoints/class-tainacan-rest-metadata-sections-controller.php#L363
- https://plugins.trac.wordpress.org/browser/tainacan/tags/1.0.1/classes/api/endpoints/class-tainacan-rest-metadata-sections-controller.php#L363
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.