Tourfic Pro CVE-2026-39774

The target must run the Tourfic Pro plugin (the paid extension of the Tourfic travel/hotel booking plugin) at version 1.17.3 or earlier on WordPress, reachable over the network. Per the CVSS vector (PR:L), the attacker needs a low-privilege authenticated account (e.g., a self-registered subscriber), and no user interaction is required (UI:N). LIMITING FACTOR AND CONFLICT: the vendor description instead calls this 'Unauthenticated,' which would remove the account prerequisite entirely; defenders should verify whether open user registration or an unauthenticated endpoint is the true precondition, as this determines whether every visitor or only registered users can exploit it. Exploitation is further bounded by the plugin's limited installed base.

This is a credible priority for any site running the affected plugin, but the signals are incomplete and internally conflicting. The CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N) reflects network-reachable, low-complexity exploitation with high confidentiality, integrity and availability impact - consistent with a privilege-escalation flaw (CWE-266) that lets a low-privileged WordPress account gain administrator control. However, there is a direct conflict: the description labels this 'Unauthenticated Privilege Escalation' while the CVSS vector specifies PR:L (authenticated, low privileges). These cannot both be literally true - if exploitation is truly unauthenticated the vector should read PR:N - so the real attack surface (any visitor vs. any registered subscriber) must be verified with Patchstack/vendor before final triage. No EPSS score, no CISA KEV listing, and no public exploit (POC) were provided, so there is no evidence of active exploitation or weaponization; the elevated score is driven entirely by the CVSS impact/exploitability metrics rather than observed real-world attack telemetry. Net: treat as a high-severity patch-soon item for exposed Tourfic Pro installs, but note the risk is bounded by the plugin's limited deployment footprint and by the unresolved authentication question.

An attacker with (per the CVSS vector) a low-privileged account on a WordPress site running Tourfic Pro <= 1.17.3 sends a crafted request to a vulnerable plugin endpoint that incorrectly assigns privileges, elevating the account to administrator. If the vendor's 'unauthenticated' labeling is accurate, this could instead be performed with no account at all. No public exploit code was identified at time of analysis, and low attack complexity (AC:L) means exploitation would be reliable once the request format is known.