CVE-2026-14240
Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
| Vendor | unknown |
| Product | tourmaster |
| Published | Aug 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown tourmaster
Be the first to know when new unknown vulnerabilities affecting unknown tourmaster are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / tourmaster
0 < 5.4.9
References
Credits
WPScan