A blind SQL injection vulnerability has been identified in the Tainacan WordPress plugin, specifically affecting versions up to and including 1.0.3. The vulnerability is classified as CVE-2026-42740 and involves improper neutralization of special elements used in SQL commands. This security flaw allows attackers to perform blind SQL injection attacks against affected installations. The vulnerability has been documented by both the National Vulnerability Database (NVD) and Patchstack. Organizations using the affected versions of the Tainacan plugin should update to a patched version to mitigate this security risk.