The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to …

The Tainacan plugin for WordPress is affected by a time-based blind SQL injection vulnerability via the 'geoquery' parameter in all versions up to and including 1.0.3. The flaw stems from insufficient escaping of user-supplied input and inadequate preparation of existing SQL queries. Unauthenticated attackers can exploit this vulnerability to append malicious SQL queries and extract sensitive information from the database. No authentication is required to exploit this issue, significantly raising its risk level. A fix has been committed to the GitHub repository. The vulnerability is tracked as CVE-2026-6230 and has been documented by both NVD and Wordfence.