CVE-2026-14239 Overview
CVE-2026-14239 affects the tourmaster WordPress plugin in versions before 5.4.8. The plugin stores a custom-filter label from a request parameter without performing a nonce check and echoes that label on the filter admin page without escaping. An unauthenticated attacker can craft a malicious request that, when triggered by a logged-in administrator, stores attacker-controlled JavaScript in the admin area. This combines Cross-Site Request Forgery (CSRF) with stored Cross-Site Scripting (XSS) [CWE-79, CWE-352].
Critical Impact
A successful attack executes arbitrary JavaScript in an administrator's browser session, enabling account takeover, plugin manipulation, and further compromise of the WordPress site.
Affected Products
- tourmaster WordPress plugin versions prior to 5.4.8
- WordPress sites with an authenticated administrator session
- Any site exposing the plugin's custom-filter admin page
Discovery Timeline
- 2026-07-30 - CVE-2026-14239 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-14239
Vulnerability Analysis
The tourmaster plugin exposes an endpoint that accepts a custom-filter label from a request parameter and writes it to persistent storage. The endpoint does not validate a WordPress nonce, so any external site can submit the request on behalf of a logged-in administrator. The stored label is later rendered on the filter admin page without HTML escaping, allowing injected <script> payloads to execute in the administrator's browser context.
This chain elevates a client-side social-engineering trigger into persistent server-side content injection. Because the payload lives in the plugin's stored configuration, it fires every time an administrator visits the filter admin page.
Root Cause
The root cause is twofold. First, the write path omits a nonce validation call such as check_admin_referer() or wp_verify_nonce(), breaking CSRF protection. Second, the read path echoes the stored label directly without applying output-encoding functions such as esc_html() or esc_attr(), breaking output sanitization.
Attack Vector
An attacker hosts a page containing a hidden form or fetch() call targeting the vulnerable plugin endpoint. When a logged-in WordPress administrator visits the attacker-controlled page, the browser submits the request with the administrator's session cookies. The plugin stores the attacker's JavaScript in the custom-filter label. On the next visit to the filter admin page, the script executes with administrator privileges, enabling actions such as creating rogue users, exfiltrating nonces, or installing malicious plugins. See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-14239
Indicators of Compromise
- Unexpected <script>, onerror=, or onload= content stored inside tourmaster custom-filter labels in the database.
- New WordPress administrator accounts created shortly after an admin visited the filter admin page.
- Outbound requests from admin browser sessions to unfamiliar domains immediately after loading plugin admin pages.
Detection Strategies
- Query the WordPress database for tourmaster filter options containing HTML tags or JavaScript event handlers.
- Review web server logs for POST requests to tourmaster admin endpoints lacking a valid Referer header from the WordPress admin domain.
- Inspect browser or endpoint telemetry for script execution originating from /wp-admin/ pages that reference external hosts.
Monitoring Recommendations
- Alert on modifications to WordPress wp_options or plugin-specific option rows containing angle brackets or javascript: URIs.
- Monitor administrative account creation, role changes, and plugin installations for anomalous timing.
- Log and review all cross-origin requests reaching /wp-admin/admin-post.php and /wp-admin/admin-ajax.php.
How to Mitigate CVE-2026-14239
Immediate Actions Required
- Update the tourmaster WordPress plugin to version 5.4.8 or later on all affected sites.
- Audit the plugin's stored filter labels and remove any entries containing HTML or JavaScript.
- Review WordPress user accounts, sessions, and recently installed plugins for signs of abuse.
Patch Information
The vendor addressed the issue in tourmaster version 5.4.8. The fix introduces nonce validation on the write path and output escaping when rendering the label on the filter admin page. Refer to the WPScan Vulnerability Report for reference to the fixed version.
Workarounds
- Deactivate the tourmaster plugin until the update to 5.4.8 or later is applied.
- Deploy a Web Application Firewall (WAF) rule to block requests to the vulnerable endpoint that lack a valid WordPress nonce.
- Instruct administrators to log out of WordPress before browsing untrusted sites and to use a dedicated browser profile for admin tasks.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
