This vulnerability (CVE-2026-6230) affects the Tainacan WordPress plugin versions up to and including 1.0.3. It is a time-based blind SQL Injection caused by improper handling of the 'geoquery' parameter, which is not sufficiently escaped or prepared before being used in SQL queries. This allows unauthenticated attackers to inject additional SQL commands, potentially extracting sensitive data from the backend database. The CVSS 3.1 vector indicates it is remotely exploitable without privileges or user interaction, with high confidentiality impact but no integrity or availability impact.

Successful exploitation can lead to unauthorized disclosure of sensitive information from the database. The vulnerability does not affect data integrity or availability but poses a significant confidentiality risk due to the ability to extract data via blind SQL Injection.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable parameter if possible and monitor for suspicious activity related to SQL injection attempts targeting the 'geoquery' parameter.