Description

Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-13T14:16:57.013Z",
  "pubdate": "2026-08-13T14:16:57.013Z",
  "executiveSummary": "A broken access control vulnerability has been identified in the Tourfic plugin affecting versions <= 2.23.1. This security flaw allows authenticated users with subscriber-level privileges to perform unauthorized actions restricted to higher-privileged roles. The vulnerability exposes the affected WordPress systems to privilege abuse and unauthorized data modification or administrative function execution. Attackers possessing low-privilege subscriber accounts can leverage this vulnerability to bypass intended authorization boundaries enforced by the application logic. The risk implication is significant as it compromises the integrity and security controls of the WordPress site hosting the vulnerable plugin. Exploitation requires the attacker to authenticate as a subscriber, lowering the barrier for internal privilege escalation attacks. Remediation requires updating the Tourfic plugin to a secure version where proper capability checks and access control validations are implemented.",
  "technicalDetails": "The vulnerability resides in the access control implementation of the Tourfic plugin for versions <= 2.23.1. Specifically, the application fails to properly validate user capabilities and roles prior to processing sensitive requests, resulting in a broken access control condition. The root cause stems from missing or inadequate authorization checks within AJAX handlers, REST API endpoints, or direct function calls handling plugin-specific administrative or management tasks. Because the codebase fails to verify whether the requesting user possesses adequate privileges—such as administrator or shop manager capabilities—it implicitly trusts requests originating from authenticated sessions regardless of the assigned user role.\nThe attack flow proceeds as follows: An authenticated adversary equipped with a low-privilege subscriber account crafts an HTTP request targeting vulnerable functionality exposed by the Tourfic plugin. Due to the absence of robust capability verification functions such as current_user_can() within the underlying execution flow, the application processes the incoming request and performs the requested operation. The vulnerable component fails to restrict endpoint accessibility, permitting users assigned to restricted roles to execute actions outside their authorization scope. Depending on the specific functionality exposed, payload behavior may include modifying plugin settings, manipulating booking data, or interacting with restricted backend interfaces.\nThe attack vector requires network exposure to the WordPress application and necessitates valid authentication credentials granting subscriber-level access. No complex interaction or advanced exploitation techniques are required beyond issuing crafted HTTP requests containing the appropriate parameters to the vulnerable endpoints. The post-exploitation impact includes unauthorized state changes, potential data tampering, and privilege boundary circumvention within the context of the WordPress environment utilizing the Tourfic plugin."
}