The Tourfic plugin contains a classic SQL injection flaw that can input when processing subscriber actions. This vulnerability could allow an attacker to execute arbitrary SQL statements against, potentially exposing, modifying, or deleting sensitive data stored by the plugin. The primary security consequence is a breach of confidentiality and integrity, and in some configurations may enable further privilege escalation.

The affected product is the Themefic Tourfic WordPress plugin, any installation using version 2.22.5 or earlier is vulnerable. No specific operating system or WordPress version restrictions are noted, so any WordPress site that has not yet upgraded beyond 2.22.5 is at risk.

The CVSS score of 8.5 classifies this vulnerability as High severity. While an EPSS score is not available and it is not listed in CISA's KEV catalog, the exploitation potential remains significant. The likely attack vector is through the subscriber functionality exposed by the plugin, which may not require administrative credentials. Attackers who can submit data to the plugin could inject malicious SQL and retrieve sensitive information from the database. Until a patch is applied, the vulnerability could be exploited by a remote adversary with web-access to the site.