Tourfic Pro
Monthly
Privilege escalation in the WordPress plugin Tourfic Pro (the paid extension of the Tourfic travel and hotel booking plugin) at version 1.17.3 and earlier allows an attacker to elevate to a higher-privileged WordPress role, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting full loss of confidentiality, integrity and availability within the affected site. The CVSS vector's PR:L indicates the attacker must first hold a low-privilege authenticated account (for example a self-registered subscriber) and that no user interaction is required, but the vendor's own description labels the flaw 'Unauthenticated' - a material conflict that determines whether only registered users or any site visitor can trigger it, and defenders should verify which precondition actually applies. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the plugin's comparatively small installed base further limits real-world exposure, so this is best treated as a credible priority for sites running the plugin rather than a broadly exploited campaign.
Privilege escalation in the WordPress plugin Tourfic Pro (the paid extension of the Tourfic travel and hotel booking plugin) at version 1.17.3 and earlier allows an attacker to elevate to a higher-privileged WordPress role, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflecting full loss of confidentiality, integrity and availability within the affected site. The CVSS vector's PR:L indicates the attacker must first hold a low-privilege authenticated account (for example a self-registered subscriber) and that no user interaction is required, but the vendor's own description labels the flaw 'Unauthenticated' - a material conflict that determines whether only registered users or any site visitor can trigger it, and defenders should verify which precondition actually applies. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; the plugin's comparatively small installed base further limits real-world exposure, so this is best treated as a credible priority for sites running the plugin rather than a broadly exploited campaign.