8.1High

CVE-2026-28186WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability

themefic Travelfic Toolkit Published: 2026-08-13 16:36 (2 months ago)

Description

Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

Weakness (CWE): CWE-862

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
themefic	Travelfic Toolkit	≤ 1.5.1

References and patches

https://patchstack.com/database/wordpress/plugin/travelfic-toolkit/vulnerability/wordpress-travelfic-toolkit-… vdb-entry

CVSS score

8.1High

Source: Patchstack · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

All scores (2)

cna	CVSS 3.1	8.1High
audit@patchstack.com	CVSS 3.1	8.1High

EPSS (chance of exploitation in 30 days)

0.38%

higher than 32% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2026-02-25
Published2026-08-13 16:36
Reached IP-DB2026-10-24 23:48
Last updated2026-10-23 21:10

Assigned by (CNA): Patchstack
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — WordPress plugins & themes

Unscored

CVE-2026-110132 4 hours ago

Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and Modification

Sync Post With Other Site

The Sync Post With Other Site WordPress plugin before 1.9.4 does not properly authorize a content-management action for post types other than pages, allowing users with Contributor-level access or above to create and modify arbitrary custom post types, includ…

Unscored

CVE-2026-110963 4 hours ago

Userplace <= 1.2.0 - Unauthenticated Privilege Escalation

Userplace

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or …

Unscored

CVE-2026-104639 4 hours ago

Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via Webhook

Razorpay for WooCommerce

The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, allowing users able to obtain the webhook secret (administrators) to perform SQL injection…

Unscored

CVE-2026-105970 4 hours ago

BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment Confirmation

Thanh Toán Quét Mã QR Code Tự Động

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders…

Unscored

CVE-2026-106015 4 hours ago

Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute Force

Ecommerce Affiliate

The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification attempts, allowing unauthenticated attackers to take over any account, including admin…

Unscored

CVE-2026-109925 4 hours ago

Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare Handlers

Productive Commerce

The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks.