Tourfic CVE-2026-57392

The Tourfic plugin (version 2.22.5 or earlier) must be installed and active on a WordPress site. The CVSS vector PR:N/UI:N indicates no authentication or user interaction is required, and the 'Authentication Bypass' tag confirms the access control bypass is reachable by unauthenticated network clients. The specific plugin endpoint(s) involved are not disclosed in the advisory, which limits precise attack surface mapping. Exploitation is constrained to sites where the Tourfic plugin is active - deactivated or uninstalled plugins are not affected. There is no indication of a non-default configuration requirement; the vulnerability appears to exist in the default plugin installation state.

The CVSS 6.5 Medium score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L places this at low complexity with no authentication barrier, but the limited impact metrics (Confidentiality:None, Integrity:Low, Availability:Low) cap the damage ceiling. No EPSS data was supplied, so exploitation probability cannot be quantified numerically. The vulnerability is absent from CISA KEV, and no proof-of-concept exploit code was referenced in the Patchstack advisory or tags. Patchstack's classification as 'Authentication Bypass' and 'Broken Access Control' is consistent with the CWE-862 root cause. For production WordPress sites running Tourfic, the realistic risk is opportunistic unauthorized modification or limited disruption of tour/booking data - not data exfiltration. The niche travel-booking footprint of the plugin meaningfully limits the aggregate attack surface versus widely deployed plugins. No conflicting signals are present in the available data; however, the exact vulnerable endpoint(s) and precise impact scope are not disclosed in the advisory, which limits remediation targeting.

An unauthenticated remote attacker identifies a WordPress site running Tourfic 2.22.5 or earlier - trivially discoverable via WordPress plugin fingerprinting. The attacker sends crafted HTTP requests directly to the unprotected Tourfic endpoint, bypassing the missing authorization check to perform unauthorized modifications to tour listings or booking records, or to cause limited availability disruption. No exploit code has been publicly identified, but the low attack complexity (AC:L) and absence of any authentication requirement mean the technique is reproducible from the advisory description alone.