CVE-2026-14240

CVE-2026-14240CVE-2026-14240

Description

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.

Scoring

CVSS 5.3 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Last modified2026-08-06
Sourced from NVD. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.