Insecure File Exposure in Tourmaster WordPress Plugin
CVE-2026-14240
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 6 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-14240?
The Tourmaster WordPress plugin prior to version 5.4.9 is susceptible to an insecure file exposure vulnerability. When administrators perform an export for orders or bookings, the exported data is saved in a fixed, predictable file location within a publicly accessible directory. This lack of proper access control permits unauthenticated users to download sensitive customer information without any authentication, leading to possible data breaches.
Affected Version(s)
tourmaster 0 < 5.4.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.