CVE-2026-57395

WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability

Published Jul 13, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.

Analysis

Technical impact

This vulnerability is a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels within the Themefic Tourfic plugin for WordPress. The broken access control can let unauthorized users perform privileged actions intended for higher‑privilege accounts, potentially exposing or modifying sensitive data or site content. The weakness is classified as CWE‑862, insufficient authorization.

Affected Systems

All installations of the Themefic Tourfic plugin for WordPress at version 2.22.5 or earlier are affected. The issue applies to any WordPress site that has the Tourfic plugin enabled, regardless of the site's overall configuration or other installed plugins.

Risk and Exploitability

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote through the web interface, inferred from the plugin’s administrative UI, and the flaw arises because access control checks are insufficient.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Themefic

Tourfic

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.22.5

No data.

Vendor Product Versions

Themefic

Tourfic

Version	Status	Scheme	Platform
`[0,2.22.5]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check for the latest Tourfic version and upgrade if it includes an access control fix.
Temporarily disable or uninstall the Tourfic plugin until a patched version is available.
Restrict WordPress user role permissions so that only trusted administrators can access or configure Tourfic.
Audit Tourfic logs for anomalous activity to identify unauthorized access attempts.

Generated by OpenCVE AI on July 31, 2026 at 12:00 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.340% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-22-5-broken-access-control-vulnerability-2?_s_id=cve

History

Nov 10, 2026 9:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 13, 2026 12:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Themefic Themefic tourfic Wordpress Wordpress wordpress
Vendors & Products		Themefic Themefic tourfic Wordpress Wordpress wordpress

Jul 13, 2026 10:00 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tourfic: from n/a through <= 2.22.5.
Title		WordPress Tourfic plugin <= 2.22.5 - Broken Access Control vulnerability
Weaknesses		CWE-862
References		https://patchstack.com/database/Wordpress/Plugin/tourfic/vulnerability/wordpress-tourfic-plugin-2-22-5-broken-access-control-vulnerability-2?_s_id=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`