Description
The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any authenticated subscriber to read the email addresses of the repository's staff.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Tainacan | < 1.4.0 | 1.4.0 |
References
- https://wpscan.com/vulnerability/0b78000b-99ee-4cee-a7e9-369fc8c98093/ exploit vdb-entry technical-description