CVE-2026-14240 — Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowi…
Published: 2026-08-06 · CVSS: 5.3 · CVSS 3.1
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7