Tourfic CVE-2026-39543

Multiple signals indicate this is a low-priority vulnerability despite its moderate CVSS score. The CVSS vector shows network-accessible (AV:N), low-complexity (AC:L) exploitation requiring no authentication (PR:N), which superficially appears concerning. However, the EPSS score of 0.02% (4th percentile) reveals negligible real-world exploitation probability, suggesting limited practical attack incentive or difficulty not captured by CVSS. The vulnerability enables only confidentiality impact (C:L) with no integrity or availability compromise, further limiting severity. Absence of KEV confirmation and no public exploit code identified indicate this has not attracted active threat actor interest. This represents a classic case where CVSS overstates risk relative to actual exploitation likelihood-a disclosure-driven security concern rather than an operational priority.

An unauthenticated attacker sends a crafted HTTP request to the Tourfic plugin's insufficiently protected endpoint (such as a REST API route or AJAX handler), exploiting the missing authorization check to retrieve sensitive tour booking data, pricing information, or user details. The attacker gains information access without authentication or user interaction required, though the attack delivers only limited confidential data exposure rather than account takeover or system compromise.