CVE-2026-57392
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
The Tourfic WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.22.5.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or data, leading to privilege escalation and potential takeover of the website.
Recommendation
Immediately update the Tourfic plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in Tourfic
See all- CVE-2026-27999Medium
Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.
- CVE-2026-57395Medium
The Tourfic WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.22.5.
- CVE-2026-39543Medium
The WordPress plugin Tourfic up to version 2.21.4 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.