Tourfic CVE-2026-97470

Requires (1) the Tourfic plugin installed at version ≤3.0.1, and (2) WooCommerce active - the description states 'This requires WooCommerce to be active.' An attacker needs at least subscriber-level/WooCommerce customer authentication (PR:L), but this barrier is weak because the WooCommerce customer role is freely self-registerable without admin approval, effectively opening exploitation to any visitor who registers. Impact reaches beyond the plugin's own templates (which do sanitize via wp_kses_post()) specifically because the stored comment content is served unsanitized through the unauthenticated GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and post/comment RSS feeds; the practical blast radius therefore depends on whether any headless front-end, feed reader, or third-party widget renders that comment content. Limiting factors: the WooCommerce dependency (non-default on many sites), the need to register an account, and the Low confidentiality/integrity impact typical of reflected script execution rather than direct server compromise.

This is a genuine but moderate-priority issue, best characterized as a high-reach-but-limited-impact stored XSS rather than a critical flaw. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) indicates network-reachable, low-complexity exploitation requiring only low privileges with a scope change - consistent with the description, since the attacker needs a self-registerable WooCommerce customer account and the injected script executes in other users' security contexts. The key risk amplifier is NOT severity but reachability: the description states the payload is returned unsanitized via the UNAUTHENTICATED GET /wp-json/wp/v2/comments REST endpoint (content.rendered) and RSS feeds, meaning the plugin's own wp_kses_post() output escaping on listing-page templates does not protect headless clients, feed readers, or third-party widgets. No EPSS score, KEV listing, or POC was provided in the input, so there is no signal of active or widespread exploitation. The authentication barrier is real on paper (PR:L) but practically low because the customer role is freely self-registerable without admin approval, as the description notes. Net: real but moderate - prioritize for WordPress sites running this plugin with WooCommerce active and any headless/feed consumer, deprioritize for isolated standard installs. Note one caveat: exploitation is gated on WooCommerce being active, a non-default dependency that the raw CVSS score does not reflect.

An attacker self-registers a free WooCommerce customer account on a target site running Tourfic (≤3.0.1), then submits a review/comment containing a malicious script that is stored without sanitization. When any user - or a headless client, feed reader, or third-party widget - retrieves the comment via the unauthenticated /wp-json/wp/v2/comments REST endpoint or the post/comment RSS feed, the script executes in their browser context. No public exploit was identified at time of analysis, though the attack path is explicitly described by the reporting source (Wordfence).