Skip to main content

Tourfic CVE-2024-29136

HIGH
Deserialization of Untrusted Data (CWE-502)
2024-03-19 audit@patchstack.com
WordPress Deserialization Tourfic Wordpress Plugin Themefic
8.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
CVSS changed
Apr 23, 2026 - 15:22 NVD
8.8 (HIGH) 8.5 (HIGH)
CVE Published
Mar 19, 2024 - 14:15 nvd
HIGH 8.8
CVE Published
Mar 19, 2024 - 14:15 cve.org
HIGH 8.5

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.This issue affects Tourfic: from n/a through <= 2.11.17.

AnalysisAI

Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.11.17. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Deserialization of Untrusted Data (CWE-502), which allows attackers to execute arbitrary code through malicious serialized objects. Deserialization of Untrusted Data vulnerability in Themefic Tourfic tourfic.11.17. Affected products include: Themefic Tourfic.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Avoid deserializing untrusted data. Use safe serialization formats (JSON). Implement integrity checks and type allowlists.

More in Tourfic

View all
CVE-2024-29137 HIGH POC
7.1 Mar 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic t
CVE-2024-29135 CRITICAL
9.9 Mar 19

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic.11.15. Rated critical severity
CVE-2025-24650 CRITICAL
9.1 Jan 24

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic allows Upload a Web Shell to a Web Ser
CVE-2026-27999 MEDIUM
6.5 Aug 13

Broken Access Control in the Tourfic WordPress plugin (all versions up to and including 2.23.1) allows authenticated sub
CVE-2024-29134 MEDIUM
6.5 Mar 19

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themefic Tourfic t
CVE-2026-57395 MEDIUM
6.5 Jul 13

Missing Authorization (CWE-862) in the Tourfic WordPress plugin through version 2.22.5 permits authenticated low-privile
CVE-2026-57392 MEDIUM
6.5 Jul 13

Tourfic, a WordPress travel booking plugin by Themefic, exposes unauthenticated access control bypass through missing au
CVE-2024-12032 MEDIUM
6.5 Dec 25

The Tourfic - Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin | WooCommerce Booking plugin f
CVE-2026-39543 MEDIUM
5.3 Apr 08

Missing authorization in Themefic Tourfic WordPress plugin versions up to 2.21.4 allows unauthenticated remote attackers
CVE-2024-8319 MEDIUM
4.3 Aug 30

The Tourfic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.11.

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9

Share

CVE-2024-29136 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy