What is the CVSS score of CVE-2026-27999?

CVE-2026-27999 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Tourfic CVE-2026-27999

EUVD-2026-57940 MEDIUM

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-cxxq-7986-q99h

WordPress Authentication Bypass Tourfic Wordpress Plugin Themefic

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint exploitable by any subscriber (PR:L); only confidentiality affected as BAC allows data read, not modification or disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 15:20 vuln.today

DescriptionCVE.org

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

AnalysisAI

Broken Access Control in the Tourfic WordPress plugin (all versions up to and including 2.23.1) allows authenticated subscriber-level users to access restricted functionality or data beyond their intended authorization scope. The flaw stems from missing authorization checks (CWE-862), enabling low-privileged authenticated users to bypass access controls and retrieve sensitive information, as reflected by the High confidentiality impact in the CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low-complexity, network-accessible nature of the flaw makes it straightforward to exploit for any registered site user.

Technical ContextAI

Tourfic is a WordPress travel and tour booking plugin developed by Themefic (CPE: cpe:2.3:a:themefic:tourfic:*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization), meaning one or more plugin endpoints or AJAX handlers fail to verify that the calling user possesses sufficient privileges before executing a sensitive operation. WordPress subscriber accounts are the lowest authenticated role and are freely obtainable on any site with open registration. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the issue is exploitable over the network at low complexity, requiring only a subscriber-level account - consistent with a REST or admin-ajax endpoint that lacks a capability check such as current_user_can().

RemediationAI

Update the Tourfic plugin to a version greater than 2.23.1 as soon as a patched release is available from Themefic via the WordPress plugin repository. No exact patched version number was confirmed in the available source data - check the WordPress.org plugin page or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-23-1-broken-access-control-vulnerability for the latest confirmed fix version before upgrading. As an interim compensating control, site administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to eliminate the trivial account creation path that enables exploitation by anonymous attackers; note this may impact legitimate site workflows. Additionally, a Web Application Firewall (WAF) rule targeting the specific vulnerable endpoint - identifiable from the Patchstack report - can block exploit attempts without requiring a plugin update, though this requires WAF access and the specific endpoint detail.