Tainacan WordPress Plugin Missing Authorization Vulnerability Allows Unauthenticated Metadata Section Creation

A vulnerability exists in the Tainacan plugin for WordPress, in all versions up to and including 1.0.1. The issue stems from the 'create_item_permissions_check()' function, which fails to properly validate authentication and authorization. This oversight allows unauthenticated users to create arbitrary metadata sections for any collection through the public REST API, as long as they can access the WordPress site.

Impact

Exploitation of this vulnerability allows for the unauthorized creation of metadata sections, which could be misused to manipulate or disrupt the organization of content within WordPress collections.

Remediation

Users are advised to update the Tainacan WordPress plugin to version 1.0.2 or a newer patched version.