Tourfic EUVD-2026-57940

Exploitation requires the attacker to hold a valid WordPress subscriber-level (or higher) account on the target site. If the WordPress site has open user registration enabled, any anonymous internet user can self-register and immediately exploit this flaw. If registration is disabled and accounts are admin-provisioned, exploitation is limited to existing authenticated users (e.g., malicious insiders or compromised accounts). The Tourfic plugin must be installed and active. No specific non-default Tourfic configuration is identified as a prerequisite - the broken access control appears to affect default plugin functionality. What limits exploitation: the PR:L requirement prevents fully unauthenticated attacks; the impact is read-only (C:H/I:N/A:N), so an attacker cannot modify data or take down the site via this flaw alone.

The NVD CVSS 3.1 score of 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N reflects a realistic and moderate-to-elevated real-world risk for affected deployments. The Low Privileges requirement (PR:L) is the primary limiting factor - exploitation requires an attacker to first hold a valid subscriber account on the target WordPress site, which on sites with open registration is trivially obtained. No EPSS score was provided in the source data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. No public exploit code (POC) has been identified. The impact is confined to confidentiality (C:H/I:N/A:N), meaning an attacker can read restricted data but cannot modify content or disrupt availability. For WordPress sites in travel or tour booking niches with open user registration enabled, this represents a meaningful data exposure risk; for sites requiring admin-created accounts, the attack surface is considerably narrower.

An attacker registers a free subscriber account on a target WordPress travel booking site running Tourfic 2.23.1 or earlier, then sends a crafted authenticated HTTP request (e.g., a wp-admin/admin-ajax.php action or REST API call) to an endpoint that lacks proper capability checks. The missing authorization allows the subscriber to retrieve booking records, customer personally identifiable information, or other restricted plugin data that should be accessible only to editors or administrators. No public exploit code is required given the low complexity of the attack.