EUVD-2026-53720
GHSA-qxc3-54m6-6c84
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
AC:H reflects that exploitation depends on an administrator having previously run an export - a prerequisite entirely beyond the attacker's control; no integrity or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
AnalysisAI
tourmaster WordPress plugin (all versions before 5.4.9) exposes exported customer booking and order data via a fixed, predictable file path inside its publicly accessible web directory, with no authentication or access control enforcing download restrictions. Any unauthenticated network attacker who knows or can derive the static export file URL can retrieve personally identifiable information - names, contact details, and booking records - after an administrator has triggered an export. A publicly available proof-of-concept exists per WPScan, and exploitation is fully automatable (SSVC), though EPSS sits at 0.14% and no CISA KEV listing exists at time of analysis.
Technical ContextAI
tourmaster is a WordPress tour-booking and management plugin that supports order and customer export functionality for site administrators. The vulnerability, classified under CWE-200 (Exposure of Sensitive Information to Unauthorized Actor), arises because the plugin writes export output to a hard-coded, non-randomized filename within its own plugin directory - a path that is served directly by the WordPress web root without any server-side access control, WordPress nonce verification, or capability check. The CPE is cpe:2.3:a:unknown:tourmaster:*:*:*:*:*:*:*:* covering all versions up to but not including 5.4.9. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms the file is reachable over the network without any credentials or user interaction once placed.
RemediationAI
Update the tourmaster WordPress plugin to version 5.4.9 or later, which is confirmed by the WPScan advisory (https://wpscan.com/vulnerability/17ac2656-3fb4-40c4-b349-a376df61f288/) to resolve the predictable file exposure. As an immediate compensating control prior to patching, administrators should add a .htaccess rule (on Apache) or equivalent Nginx location block to deny direct HTTP access to the plugin's export subdirectory, preventing public file download while the plugin continues operating. Administrators should also delete any previously generated export files from the plugin directory immediately, as those files remain exposed until removed regardless of plugin version. Avoid running additional exports until the patch is applied. The trade-off of the .htaccess workaround is that it may break legitimate export download flows if the plugin relies on direct file serving rather than a PHP download handler.
More in Tourmaster
View allStored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenti
Local File Inclusion in the GoodLayers Tourmaster WordPress plugin (versions <= 5.4.5) allows low-privileged authenticat
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated at
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today