EUVD-2026-53720
GHSA-qxc3-54m6-6c84
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AC:H reflects that exploitation depends on an administrator having previously run an export - a prerequisite entirely beyond the attacker's control; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
AnalysisAI
tourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, predictable file path inside its publicly accessible web directory, with no authentication or access control enforcing download restrictions. Any unauthenticated network attacker who knows or can derive the static export file URL can retrieve personally identifiable information - names, contact details, and booking records - after an administrator has triggered an export. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete preconditions: (1) the tourmaster plugin must be installed and active on a WordPress site running any version before 5.4.9, and (2) a site administrator must have previously executed an order or booking export using the plugin's export feature, causing the fixed-path file to exist on disk. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 (Medium) with AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N reflects a purely confidentiality-impacting, unauthenticated network flaw with no integrity or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the tourmaster WordPress plugin to version 5.4.9 or later, which is confirmed by the WPScan advisory (https://wpscan.com/vulnerability/17ac2656-3fb4-40c4-b349-a376df61f288/) to resolve the predictable file exposure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Tourmaster
View allStored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenti
Local File Inclusion in the GoodLayers Tourmaster WordPress plugin (versions <= 5.4.5) allows low-privileged authenticat
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated at
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today