Summary
CVE-2026-6230 is a time-based blind SQL injection vulnerability in the Tainacan plugin for WordPress, affecting all versions up to and including 1.0.3. The flaw resides in the plugin’s geocoordinate query builder and is exploitable by unauthenticated, remote attackers via the geoquery parameter, requiring no privileges or user interaction. It carries a CVSS v3.1 base score of 7.5 (HIGH) and enables extraction of sensitive data from the underlying WordPress database.
Technical details
- Root cause: The geocoordinate query builder (
class-tainacan-geocoordinate-helper.php) constructs SQL queries through raw string concatenation of user-supplied geographic data, without sufficient input escaping or use of parameterized query preparation — violating CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). - Trigger conditions: An unauthenticated attacker submits a maliciously crafted value to the
geoqueryparameter exposed via the plugin’s REST API endpoint for geocoordinate-based item searches. No account or session is required. - Attack vector: Fully remote, over the network. Low attack complexity; no authentication and no user interaction needed.
- Impact: High confidentiality impact. Successful exploitation allows an attacker to append arbitrary SQL statements to existing queries and perform time-based blind extraction of sensitive database contents — including WordPress user credentials, hashed passwords, session data, and any other records stored in the database.
Affected software
- Tainacan WordPress Plugin — all versions up to and including 1.0.3
Severity
- CVSS v3.1 Base Score: 7.5 (HIGH)
- Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Mitigation and recommended actions
- Immediate: Update the Tainacan plugin to version 1.2.0 or later. The patch replaces unsafe SQL string concatenation in the geocoordinate query builder with parameterized queries using WordPress’s
$wpdb->prepare(), and adds coordinate format and numeric validation prior to query construction. - If immediate patching is not feasible: Restrict external network access to the Tainacan REST API endpoints, or disable the Geocoordinate metadata type within the plugin’s administration interface until the update can be applied.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

