medium5.3
CVE-2026-14240
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no acce…
Impact
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
Affected products
| Product | Affected versions |
|---|---|
| Tourmaster WordPress Plugin | before 5.4.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.