CVE-2025-12747CWE-552

CVE-2025-12747

Medium · published November 21, 2025

CVSS v3.1

5.3

EPSS

Percentile

23.1

In the wild

Unconfirmed

What it is

The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being exposed in wp-content without adequate protection. This makes it possible for unauthenticated attackers to extract potentially sensitive information from files that have been marked as private.

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00314 · 23.1th percentile
Weakness: CWE-552 · Files or Directories Accessible to External Parties
Published: 2025-11-21T22:15Z

References (3)

https://github.com/tainacan/tainacan/blob/2491612ee9d5b14baa70862ba2308ee925de0938/src/classes/class-tainacan-private-files.php · [email protected]https://github.com/tainacan/tainacan/compare/1.0.0...1.0.1 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/c64869f0-a4dd-4135-8ed8-a6ff82a48e1f?source=cve · [email protected]

EPSS history

Timeline

21 NOV 16:28Z
Tainacan <= 1.0.0 - Unauthenticated Information Exposure
cvelistv5