An unauthenticated user can exploit a privilege control weakness in tourfic pro versions 1.17.3 and earlier to gain higher access levels within the WordPress environment. The vulnerability is classified as CWE-266. With elevated privileges, an attacker could modify, create, or delete content, adjust plugin settings, or potentially run arbitrary code if the plugin allows admin operations that execute system commands. The impact is a loss of integrity and potential compromise of the entire site.

WordPress users running the Tourfic Pro plugin from Tourfic AI Studio on version 1.17.3 or earlier. The vulnerability is specific to that plugin release and does not affect other WordPress core components.

The CVSS score of 8.8 identifies this flaw as high severity. Exploitation does not require authentication, implying anyone with web access to the site can trigger the privilege escalation. The EPSS score is < 1%, and the vulnerability is not listed in CISA KEV, but the exposed attack surface and high CVSS suggest a significant risk level. Attackers can manually or programmatically send crafted requests to the plugin’s endpoints to elevate privileges and perform malicious actions with administrative rights.