CVE-2026-39543
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The WordPress plugin Tourfic up to version 2.21.4 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may gain access to protected functions or data, potentially leading to information disclosure or unauthorized actions.
Recommendation
Update the Tourfic plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Tourfic
See all- CVE-2026-27999Medium
Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.
- CVE-2026-57395Medium
The Tourfic WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.22.5.
- CVE-2026-57392Medium
The Tourfic WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.22.5.
Original NVD description (English source)
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.21.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS