What is the CVSS score of CVE-2025-69133?

CVE-2025-69133 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Tourmaster are affected by CVE-2025-69133?

The GoodLayers Tourmaster WordPress plugin (versions ≤5.4.5) contains a local file inclusion vulnerability allowing subscriber-level authenticated users to read sensitive server files including…

How to fix or mitigate CVE-2025-69133?

Within 24 hours: Inventory WordPress installations using GoodLayers Tourmaster and identify current versions. Within 7 days: Implement compensating controls-disable the plugin if not critical, restrict Subscriber role permissions, and harden file system permissions on configuration files. Within 30 days: Monitor Patchstack security advisories for patch availability; establish upgrade testing and deployment plan to version >5.4.5 once released.

Tourmaster CVE-2025-69133

EUVD-2025-210402 HIGH

PHP Remote File Inclusion (CWE-98)

2026-07-02 Patchstack

GHSA-q5mp-p378-cg2q

LFI Information Disclosure PHP Tourmaster

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.3 MEDIUM

Subscriber authentication gives PR:L and stated high complexity gives AC:H; as an information-disclosure LFI the impact is confidentiality-only, so I:N and A:N.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:05 vuln.today

DescriptionCVE.org

Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions.

AnalysisAI

Local File Inclusion in the GoodLayers Tourmaster WordPress plugin (versions <= 5.4.5) allows low-privileged authenticated users at the Subscriber level to include and read arbitrary local files from the server, exposing sensitive data such as configuration files and credentials. Reported through Patchstack and mapped to CWE-98, the flaw carries a CVSS 7.5 (High) score with high attack complexity; no public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Tourmaster is a companion plugin distributed by GoodLayers (CPE cpe:2.3:a:goodlayers:tourmaster) for their travel/tour-oriented WordPress themes, providing booking, tour, and content-management features implemented in PHP. The root cause is CWE-98 (Improper Control of Filename for Include/Require Statement in a PHP Program), meaning user-influenced input reaches a PHP include/require path without adequate sanitization or allow-listing. In the LFI variant flagged here (tagged Information Disclosure/LFI), an attacker steers the include path toward existing local files rather than a remote resource, causing the application to read and process files outside the intended scope - a classic path-traversal-into-include weakness in WordPress plugin code.

RemediationAI

No vendor-released patch version is identified at time of analysis; the input only defines the affected range (<= 5.4.5) without naming a fixed build, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/tourmaster/vulnerability/wordpress-tourmaster-plugin-5-4-5-local-file-inclusion-vulnerability) and upgrade to the first Tourmaster release above 5.4.5 as soon as GoodLayers publishes it. Until a fixed version is confirmed, apply compensating controls: disable open user self-registration (set 'Anyone can register' off in WordPress General settings) to remove the Subscriber foothold the exploit depends on, which trades off legitimate self-service signup; deploy a WAF or Patchstack virtual patch to block path-traversal patterns (../, encoded traversal, php:// wrappers) against the vulnerable endpoint; and restrict or audit existing Subscriber accounts, accepting the operational overhead of manual account provisioning. If Tourmaster is not actively required, deactivating and removing the plugin fully eliminates the exposure.