What is the CVSS score of CVE-2026-28186?

CVE-2026-28186 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Travelfic Toolkit are affected by CVE-2026-28186?

The Travelfic Toolkit WordPress plugin (versions 1.5.1 and earlier) contains a broken access control vulnerability allowing subscriber-level users to execute privileged operations they should not…

How to fix or mitigate CVE-2026-28186?

Within 24 hours, conduct a comprehensive inventory of WordPress installations using Travelfic Toolkit plugin and audit active subscriber accounts for suspicious activity or unauthorized access. Within 7 days, implement a temporary remediation by either disabling the plugin entirely or restricting subscriber user role permissions through WordPress security hardening (remove subscriber capabilities for sensitive operations), and establish enhanced monitoring of user activity logs. Within 30 days, monitor the Travelfic Toolkit vendor advisory channels for a patched version, and plan a deployment timeline for upgrading to any released patch; if no patch is issued, evaluate permanent alternative plugins or maintain compensating controls indefinitely.

Travelfic Toolkit CVE-2026-28186

EUVD-2026-57964 HIGH

Missing Authorization (CWE-862)

2026-08-13 Patchstack

GHSA-qrc3-6h55-j468

WordPress Authentication Bypass Wordpress Plugin Travelfic Toolkit Themefic

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Subscriber-level account required justifies PR:L; network-accessible WordPress endpoint with no interaction; no confidentiality impact confirmed by description and CVSS.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:51 vuln.today

CVE Published

Aug 13, 2026 - 13:36 cve.org

HIGH 8.1

DescriptionCVE.org

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

AnalysisAI

Broken access control in the Travelfic Toolkit WordPress plugin (versions <= 1.5.1) permits subscriber-level authenticated users to execute privileged operations without proper authorization enforcement, yielding high integrity and availability impact on the affected installation. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails entirely to verify whether a requesting user holds the necessary capabilities before processing sensitive actions. No public exploit code and no active exploitation have been identified at time of analysis.

Technical ContextAI

Travelfic Toolkit is a WordPress plugin by Themefic (CPE: cpe:2.3:a:themefic:travelfic_toolkit:*:*:*:*:*:*:*:*) providing travel-themed site functionality. The root cause is CWE-862 (Missing Authorization): the plugin exposes one or more AJAX handlers or REST API endpoints that execute privileged operations without attaching WordPress capability checks (e.g., current_user_can()) or nonce verification gated to higher roles. WordPress assigns 'subscriber' as its lowest default authenticated role, typically permitting only profile reads and comment posting. When plugin code omits authorization gates on sensitive actions, any subscriber-level session token becomes sufficient to trigger high-impact operations. This pattern is endemic to WordPress plugin ecosystems where developers add functionality incrementally without consistently applying the principle of least privilege to every registered hook.

RemediationAI

The primary remediation is to update Travelfic Toolkit to a version beyond 1.5.1; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/travelfic-toolkit/vulnerability/wordpress-travelfic-toolkit-plugin-1-5-1-broken-access-control-vulnerability for the confirmed patched release number, as the specific fix version was not independently confirmed in the available intelligence data. If an immediate update is not possible, disabling public user registration (Settings > General > uncheck 'Anyone can register') eliminates the easiest path to a subscriber account, though this blocks legitimate new registrations as a trade-off. A web application firewall rule targeting the vulnerable plugin's AJAX action names or REST endpoints can serve as an additional compensating control; however, the specific endpoint identifiers are not disclosed in the current intelligence and would require dynamic analysis to enumerate. Plugin deactivation until patching is feasible provides the strongest interim protection at the cost of losing plugin functionality entirely.