CVE-2024-1435 is a medium severity (CVSS 5.3) sensitive information exposure in the Tainacan plugin for WordPress, in versions up to and including 0.20.6. The title of the Patchstack entry describes data exposure through a log file. Update to a release after 0.20.6 and check what your logs contain.
What's affected
The NVD record says Tainacan is affected from "n/a" through 0.20.6, which means every release up to and including 0.20.6.
The record has two references, both to a Patchstack database entry whose title describes sensitive data exposure via a log file. I could not retrieve the entry when writing, and the record does not name a fixed version. Check the plugin changelog on WordPress.org for the first release after 0.20.6 and use it as the minimum.
The record does not say what authentication is needed, so assume a visitor may be able to reach the exposed data until the advisory says otherwise.
How to check if you're exposed
List the plugin version with WP-CLI:
wp plugin list --name=tainacan --fields=name,status,version
Any version at or below 0.20.6 is affected. Then look at the plugin's upload and log directories under wp-content for log files, and check whether your web server serves them directly. If a log file can be fetched by URL, treat anything inside it as exposed.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the installed Tainacan version.
- Update to the first release after 0.20.6 shown in the plugin changelog.
- Find log files created by the plugin and move or delete them, after taking a copy for review.
- Block direct web access to log directories at the web server.
- Rotate any credentials or tokens you find in those logs.
Why it matters
The class is CWE-201, insertion of sensitive information into sent data. Something the plugin recorded or sent contained information that should have stayed private.
A medium score fits an information leak with no direct code execution. The harm depends on what the log holds in your installation. Logs often contain request details, internal paths and sometimes tokens, which help an attacker build a second step. The record's KEV flag is false.
Quick check
What is the first thing to check after updating?
Whether old log files are still present and reachable by URL. An update does not remove files that were already written.
Is a fixed version named?
Not in the record. Check the plugin changelog.
Sources
- Patchstack entry for Tainacan 0.20.6 (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1435
Last reviewed: 19 October 2026.
