CVE-2026-14240: TourMaster WordPress Information Leak

CVE-2026-14240 Overview

CVE-2026-14240 affects the TourMaster WordPress plugin in versions before 5.4.9. The plugin writes order and booking exports to a fixed, predictable file path inside its publicly accessible directory. No access control protects the exported file. Unauthenticated attackers can download exported customer personal information once an administrator runs an export. The flaw exposes booking records, contact details, and other personally identifiable information (PII) collected through the plugin's tour booking workflows.

Critical Impact
Unauthenticated remote attackers can retrieve exported customer PII from any WordPress site running TourMaster before 5.4.9 after an admin export.

Affected Products

TourMaster WordPress plugin versions prior to 5.4.9
WordPress sites using TourMaster order and booking export functionality
Customer PII stored in TourMaster booking records

Discovery Timeline

2026-08-06 - CVE-2026-14240 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-14240

Vulnerability Analysis

The TourMaster plugin exports order and booking data to a static file location. The path resides inside the plugin's public web directory served by the WordPress instance. The export routine does not apply authentication checks, capability checks, or randomized filenames. Any client that knows or guesses the export path can request the file directly through HTTP.

This is an information disclosure issue caused by broken access control combined with a predictable resource location. It falls under the categories of Sensitive Data Exposure and Insecure Direct Object Reference. Exported files typically contain booking identifiers, customer names, email addresses, phone numbers, and travel details.

Root Cause

The root cause is a design flaw in the export handler. The handler writes CSV or similar structured output to a fixed filename within the plugin's wp-content/plugins/tourmaster/ tree instead of a protected directory. WordPress serves the plugin directory directly through the web server. The plugin does not add .htaccess restrictions, does not use nonces for file retrieval, and does not enforce administrator capability checks on download.

Attack Vector

An attacker performs reconnaissance on target WordPress sites running TourMaster. The attacker issues an unauthenticated HTTP GET request to the known export file path. If an administrator has previously triggered an export, the server returns the file contents. The attacker harvests PII without triggering authentication logs or admin-side alerts. Automated scanners can enumerate this path across many WordPress sites at scale.

Detailed technical analysis is available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-14240

Indicators of Compromise

Unauthenticated HTTP GET requests targeting files under /wp-content/plugins/tourmaster/ from non-administrative IP addresses
Access log entries showing successful 200 responses to export file paths from unknown user agents
Bulk or repeated requests to the plugin directory from scanning infrastructure
Unexpected downloads of CSV or export-format files from the plugin path

Detection Strategies

Review WordPress and web server access logs for direct requests to the TourMaster plugin directory
Inspect the plugin directory for exported files containing customer records that should not be web-accessible
Deploy web application firewall (WAF) rules that block direct requests to plugin export files
Correlate administrator export actions with subsequent external access to the same file path

Monitoring Recommendations

Alert on any HTTP 200 response returning CSV or JSON content from /wp-content/plugins/tourmaster/ to external clients
Monitor for new file creation events inside the plugin directory using file integrity monitoring
Track outbound data volumes from WordPress sites that host booking data
Log and review all administrator-initiated export actions in TourMaster

How to Mitigate CVE-2026-14240

Immediate Actions Required

Upgrade the TourMaster plugin to version 5.4.9 or later on all affected WordPress installations
Delete any existing exported files inside the TourMaster plugin directory
Audit web server access logs for prior unauthorized access to export file paths
Notify affected customers if evidence indicates their PII was retrieved by unauthorized parties

Patch Information

The vendor addressed CVE-2026-14240 in TourMaster version 5.4.9. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin files manually. Verify the version through wp plugin list after upgrade. See the WPScan Vulnerability Report for advisory details.

Workarounds

Block public access to /wp-content/plugins/tourmaster/ at the web server or WAF layer until patching completes
Add .htaccess deny rules for CSV, XLS, and export file extensions inside the plugin directory
Restrict administrator export functionality until the plugin is updated
Move any exported data to a protected location outside the web root immediately after generation

bash

# Apache .htaccess mitigation to block direct export access
<FilesMatch "\.(csv|xls|xlsx|json)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* /wp-content/plugins/tourmaster/.*\.(csv|xls|xlsx|json)$ {
    deny all;
    return 403;
}