CVE-2026-39774: WordPress Tourfic Pro plugin <= 1.17.3 - Privilege Escalation vulnerability
Published Oct 6, 2026
·Updated
Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.
Affected Software
1 affected component
Themefic Tourfic Pro<=1.17.3
Event History
Oct 6, 2026
CVE Published
via MITRE·08:34 AM
Data Sourced
via MITRE·08:34 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What impact is indicated by the CVSS vector?
The CVSS vector indicates high impact to confidentiality, integrity, and availability. It is remotely reachable, has low attack complexity, requires no user interaction, and does not change scope.
2
Does exploitation require an authenticated account?
The provided data is inconsistent: the description calls the issue unauthenticated, while the CVSS vector specifies PR:L, meaning low privileges are required. Treat the authentication requirement as unconfirmed from this data alone.