CVE-2026-27999
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.
Risk Assessment
Subscribers may access sensitive functions, potentially leading to data integrity issues or unauthorized changes.
Recommendation
Update Tourfic to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in Tourfic
See all- CVE-2026-57395Medium
The Tourfic WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.22.5.
- CVE-2026-57392Medium
The Tourfic WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.22.5.
- CVE-2026-39543Medium
The WordPress plugin Tourfic up to version 2.21.4 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS