5.3
Moyenne
CVE-2026-14240 The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its…
Description
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| tourmaster 5.4 | premières → < 5.4.9 | 5.4.9 |
Autres CVE de tourmaster
Les 4 CVE de tourmaster →
CVE-2026-14239
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken…
7.1
Élevée
CVE-2024-12400
The tourmaster WordPress plugin before 5.3.5 does not escape generated URLs before outputting them in attributes,…
7.1
Élevée
CVE-2024-11356
The tourmaster WordPress plugin before 5.3.4 does not sanitise and escape some parameters when outputting them in the…
6.1
Moyenne