Tourfic Plugin Vulnerable to Cross-Site Request Forgery

CVE-2024-8319

Summary

The Tourfic plugin for WordPress has a vulnerability that exposes the system to Cross-Site Request Forgery (CSRF) attacks. This issue arises from an absence or faulty implementation of nonce validation across multiple functions, including those that manage order status, visitor details, and check-in/out operations. As a consequence, unauthenticated attackers may exploit this vulnerability to forge requests, thereby executing actions that should require authentication. This includes the ability to resend order status emails, alter visitor or order information, edit check-in and check-out data, change order statuses, perform bulk updates, and delete specific data fields. The flaw underscores the importance of proper nonce validation to ensure that actions are performed by legitimate users.

References