Tourmaster EUVD-2025-210402

Exploitation requires an authenticated account at the Subscriber level (CVSS PR:L), so the site must permit that user to exist - most impactful where WordPress self-registration is enabled, and blocked entirely where registration is closed and Subscriber accounts are not issued. The Tourmaster plugin (<= 5.4.5) must be installed and active, and the vulnerable file-inclusion code path must be reachable by the authenticated request over the network (AV:N, UI:N - no victim interaction needed). High attack complexity (AC:H) is an explicit limiting factor: successful inclusion likely depends on knowing or brute-forcing a valid traversal path and satisfying non-trivial conditions, reducing the reliability of opportunistic attacks against default configurations.

Signals are mixed and point to a real-but-gated issue rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.5) requires network access but only Subscriber-level privileges (PR:L) and imposes high attack complexity (AC:H), which materially limits reliable exploitation. There is no EPSS value, no SSVC decision data, and no KEV listing supplied, so exploitation is best summarized as 'no public exploit identified at time of analysis.' The vendor-scored I:H and A:H are worth scrutiny: the vulnerability is tagged Information Disclosure/LFI, for which confidentiality impact (C:H) is the clearly justified outcome, while integrity and availability at High appear optimistic unless the LFI chains into code execution (e.g., log poisoning or including attacker-controlled uploads) - verify the integrity/availability claims with Patchstack before treating them as confirmed. Because Subscriber registration is enabled on many WordPress sites, the PR:L barrier is often low in practice, which raises effective risk on open-registration installations.

An attacker registers or obtains a Subscriber account on a WordPress site running Tourmaster <= 5.4.5, then sends a crafted authenticated request that manipulates a file-path parameter to traverse into a sensitive server file (for example wp-config.php), causing the plugin to include and disclose its contents. Because the CVSS vector specifies high attack complexity (AC:H), reliable exploitation may require specific path knowledge or timing; no public proof-of-concept is currently identified.