What is the CVSS score of CVE-2026-57392?

CVE-2026-57392 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Tourfic CVE-2026-57392

EUVD-2026-43465 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Tourfic Wordpress Plugin Themefic

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable unauthenticated endpoint with no user interaction required; impact limited to partial integrity and availability with no confidentiality exposure.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:27 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

AnalysisAI

Tourfic, a WordPress travel booking plugin by Themefic, exposes unauthenticated access control bypass through missing authorization checks on one or more plugin endpoints, affecting all versions through 2.22.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation with limited integrity and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes opportunistic exploitation straightforward against any WordPress site with the plugin installed.

Technical ContextAI

CWE-862 (Missing Authorization) indicates the Tourfic plugin fails to verify whether the requesting user holds the required WordPress capability before executing privileged actions. This class of flaw is common in WordPress plugins that implement custom AJAX handlers or REST API routes without invoking capability checks such as current_user_can(). Tourfic provides travel agency and tour booking functionality - its affected endpoints likely relate to booking management, tour data modification, or administrative operations exposed through WordPress's request pipeline. The CPE string cpe:2.3:a:themefic:tourfic:*:*:*:*:*:*:*:* covers all releases up to the affected boundary. Because WordPress plugins often share the same HTTP surface as the host application, unprotected endpoints are reachable by any network client without prior authentication.

RemediationAI

The primary remediation is to update the Tourfic plugin to a version above 2.22.5, as all releases through that version are confirmed affected. Site administrators should apply the update via the WordPress plugin dashboard or by downloading the latest release from the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-22-5-broken-access-control-vulnerability should be consulted for exact fix version confirmation, as the provided data does not explicitly name the patched release number. If immediate patching is not feasible, a compensating control is to use a WordPress firewall or WAF (such as Patchstack MU plugin, Wordfence, or a network-layer WAF) configured to block unauthenticated requests to the specific Tourfic plugin endpoints; note that this requires identifying the exact vulnerable routes and may block legitimate functionality. Disabling the Tourfic plugin entirely eliminates the attack surface but also removes booking functionality. No other workarounds are confirmed in the available data.