What is the CVSS score of CVE-2026-57395?

CVE-2026-57395 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Tourfic CVE-2026-57395

EUVD-2026-43468 MEDIUM

Missing Authorization (CWE-862)

2026-07-13 Patchstack

WordPress Authentication Bypass Tourfic Wordpress Plugin Themefic

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

PR:L confirmed as any registered WordPress subscriber suffices; C:H reflects unauthorized read of sensitive booking data; I:N and A:N because the flaw enables disclosure only, not modification or disruption.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 11:26 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

AnalysisAI

Missing Authorization (CWE-862) in the Tourfic WordPress plugin through version 2.22.5 permits authenticated low-privilege users to exploit incorrectly configured access control levels, resulting in unauthorized high-confidentiality data exposure. The CVSS vector (PR:L, C:H, I:N) confirms that any logged-in WordPress user - such as a customer or subscriber - can read sensitive data reserved for higher-privileged roles without modifying or disrupting it. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity makes exploitation straightforward once the unprotected endpoint is located.

Technical ContextAI

CWE-862 (Missing Authorization) arises when code performs a sensitive action without verifying the requester holds a sufficient capability. In WordPress plugins, this typically means an AJAX handler or REST API endpoint is registered without a corresponding current_user_can() capability check, or with an incorrect capability level that any subscriber-tier role can satisfy. Tourfic (CPE: cpe:2.3:a:themefic:tourfic) is a travel and tour booking plugin for WordPress developed by Themefic. As a booking plugin, it likely stores reservation details, customer personal information, and pricing data - the type of confidentiality-sensitive records that C:H impact implies. The tags 'Authentication Bypass' and 'Broken Access Control' reported by Patchstack reinforce that the flaw allows a lower role to perform or view actions scoped to a higher role, without fully bypassing the login requirement.

RemediationAI

Update the Tourfic plugin to a version beyond 2.22.5 as soon as Themefic releases a patched build; monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-22-5-broken-access-control-vulnerability-2 for the confirmed fix version, which has not been independently verified at time of analysis. As an immediate compensating control, disable open user registration on WordPress sites running Tourfic by navigating to Settings > General and unchecking 'Anyone can register'; this eliminates the self-registration path that allows untrusted parties to obtain the low-privilege account required for exploitation, though it will prevent new public-facing customer account creation and may impact booking workflows. Alternatively, implement a firewall or WAF rule to restrict access to suspected Tourfic-specific AJAX or REST endpoints to known authenticated roles, accepting the trade-off of potential false-positive blocking until endpoint identification is complete.