What is the CVSS score of CVE-2026-56064?

CVE-2026-56064 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of Tourfic are affected by CVE-2026-56064?

The Tourfic WordPress plugin (versions 2.22.5 and earlier) contains a SQL injection vulnerability exploitable by any subscriber-level user, enabling direct theft of the WordPress database including…

How to fix or mitigate CVE-2026-56064?

Within 24 hours: Inventory all WordPress installations running Tourfic versions 2.22.5 or earlier; restrict open subscriber registration if operationally feasible. Within 7 days: Remove the Tourfic plugin entirely or implement database-level read-only permissions limiting the plugin's SQL access. Within 30 days: Verify plugin removal is complete; audit database access logs for unauthorized SQL queries; check Tourfic's official repository weekly for vendor-released patches and deploy immediately upon availability.

Tourfic CVE-2026-56064

EUVD-2026-39718 HIGH

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-89jf-r85v-p58j

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Remote subscriber-authenticated SQLi gives PR:L and AC:L with high confidentiality read; I assess scope unchanged and no integrity/availability impact, unlike the source's S:C/A:L.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:57 vuln.today

DescriptionCVE.org

Subscriber SQL Injection in Tourfic <= 2.22.5 versions.

AnalysisAI

SQL injection in the Tourfic WordPress plugin (versions 2.22.5 and earlier) lets authenticated subscriber-level users inject arbitrary SQL through a vulnerable parameter, exposing the WordPress database. Because only a low-privilege account is required and registration is often open on WordPress sites, an attacker can read sensitive data such as user records and credential hashes. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Tourfic is a WordPress travel/tour, hotel and apartment booking plugin that issues database queries to manage bookings and listings. This flaw is a classic CWE-89 SQL Injection: user-controllable input reachable by a subscriber is concatenated into a SQL statement without proper parameterization or sanitization, so the backend MySQL/MariaDB engine interprets attacker input as query syntax. The vulnerability lives in the plugin's PHP request handling within the standard WordPress wpdb data-access layer rather than in WordPress core itself. Exact affected components are derived from the Patchstack advisory; no CPE strings were supplied in the input.

RemediationAI

Upgrade Tourfic to the first release after 2.22.5 (the next maintenance version that addresses this issue per the Patchstack advisory); the input does not specify an exact fixed version, so confirm the patched version directly from the vendor before deploying - Patch available per vendor advisory at https://patchstack.com/database/wordpress/plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-22-5-sql-injection-vulnerability?_s_id=cve. As compensating controls until patched: disable open user self-registration (WordPress Settings > General > 'Anyone can register') to remove the subscriber prerequisite, which is the cleanest mitigation but blocks legitimate new sign-ups; deploy a WAF or Patchstack virtual patch with SQLi rules targeting the plugin's endpoints, accepting possible false positives on booking forms; and restrict or audit existing subscriber accounts, since any pre-existing low-privilege account remains a viable attacker foothold.