CVE-2026-14240

MediumCVSS 5.3

Published: 06/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 06/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control. This allows unauthenticated users to download the exported customers' personal information once an administrator has run an export.

Risk Assessment

Sensitive customer data, such as personal information, can be exposed to unauthorized individuals, violating data protection regulations.

Recommendation

Update the tourmaster plugin to version 5.4.9 or later. Additionally, ensure export files are stored in a protected directory and require authentication to download.

Other vulnerabilities in tourmaster WordPress plugin

CVE-2026-14239High
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label from a request parameter, and does not escape that label when echoing it on the filter admin page. An unauthenticated attacker can trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored XSS via CSRF).

Original NVD description (English source)

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.