CVE-2026-14240: Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin: tourmasterto a version that resolves this vulnerability.Fixed in 5.4.9 - Compensating control
Ensure the publicly accessible directory that contains Tourmaster’s order/booking export files is not accessible for unauthenticated users (add access control/authorization in front of the export location or otherwise prevent direct downloads).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14240?
The severity of CVE-2026-14240 is rated at 62, indicating a moderate risk level.
How do I fix CVE-2026-14240?
To fix CVE-2026-14240, update the Tourmaster WordPress plugin to version 5.4.9 or later.
What type of vulnerability is CVE-2026-14240?
CVE-2026-14240 is classified as an unauthenticated sensitive data disclosure vulnerability.
What information is exposed by CVE-2026-14240?
CVE-2026-14240 allows unauthenticated users to access exported personal information of customers.
What version of the Tourmaster plugin is affected by CVE-2026-14240?
CVE-2026-14240 affects versions of the Tourmaster plugin prior to 5.4.9.