Tourfic CVE-2026-57395

Exploitation requires the attacker to possess a valid WordPress account with at minimum the subscriber or customer role, satisfying the CVSS PR:L prerequisite. The Tourfic plugin must be installed and active on the target site. Sites with open user registration - the default and common configuration for public-facing tour booking platforms - face the highest exposure, as any internet user can self-register to satisfy the authentication requirement. Sites where user accounts are exclusively admin-created have a significantly reduced attack surface, as external attackers cannot trivially obtain the required credentials. Impact is limited to confidentiality (C:H, I:N, A:N): attackers can read sensitive data but cannot modify records or disrupt availability. No non-default plugin configuration is specified as a prerequisite beyond the plugin being active.

The CVSS 6.5 score with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a moderately severe, easily exploitable confidentiality breach requiring only a low-privilege authenticated account. Real-world risk is moderate-to-elevated on tour booking sites that allow public user registration - a standard deployment pattern for this plugin type, where customers register to book tours. On such sites, any visitor can self-register, satisfying the PR:L prerequisite with zero friction. Sites restricting registration to admin-invited accounts have meaningfully reduced exposure. No EPSS data was provided, and neither KEV listing nor public POC code has been identified, limiting the urgency signal. The absence of integrity and availability impact (I:N, A:N) confines potential damage to data disclosure rather than system compromise or service disruption. CVSS indicates network vector, which is consistent with a WordPress web plugin - no inconsistency noted.

An attacker registers a free customer account on a tour booking WordPress site running Tourfic, then probes the plugin's AJAX or REST endpoints to identify one lacking a capability check. The attacker sends an authenticated HTTP request to that endpoint, obtaining sensitive booking records or customer personal data belonging to other users. No public exploit code is known at time of analysis, but the low attack complexity (AC:L) means this requires only endpoint enumeration and a valid session cookie.