CVE-2026-14240
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Aug 06, 2026
Vendor
unknown
Description
The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.