CVE-2026-57395
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
The Tourfic WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 2.22.5.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or data, potentially leading to privilege escalation and compromise of system confidentiality or integrity.
Recommendation
Immediately update the Tourfic plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in Tourfic
See all- CVE-2026-27999Medium
Broken Access Control vulnerability in Tourfic up to version 2.23.1 allows a subscriber to gain unauthorized access to administrative functions.
- CVE-2026-57392Medium
The Tourfic WordPress plugin contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 2.22.5.
- CVE-2026-39543Medium
The WordPress plugin Tourfic up to version 2.21.4 suffers from a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.