CVE-2026-14240 — Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export

CVE-2026-14240

Tourmaster < 5.4.9 - Unauthenticated Sensitive Data Disclosure via Order Export PUBLISHED

Description (CNA)

The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.

Affected (CNA)

Vendor / product	Versions
Unknown / tourmaster	affected 0 before 5.4.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/17ac2656-3fb4-40c4-b349-a376df61f288/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.