CVE-2026-56064
Deferred Deferred - Pending Action

Subscriber SQL Injection in Tourfic

Publication date: 2026-06-26

Last updated on: 2026-06-26

Assigner: Patchstack

Description
Subscriber SQL Injection in Tourfic <= 2.22.5 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-26
Last Modified
2026-06-26
Generated
2026-07-16
AI Q&A
2026-06-26
EPSS Evaluated
2026-07-15
NVD
CVE-2026-56064
EUVD
EUVD-2026-39718

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
patchstack tourfic to 2.22.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WordPress Tourfic Plugin, versions 2.22.5 and below, contains a high-priority SQL Injection vulnerability (CVE-2026-56064). This flaw allows attackers to directly interact with the website's database by injecting malicious SQL code. It is classified under OWASP Top 10 A3: Injection, indicating it is a serious security issue.

Detection Guidance

The vulnerability is a SQL Injection flaw in the WordPress Tourfic Plugin versions 2.22.5 and below. Detection typically involves monitoring for suspicious SQL injection attempts targeting the plugin's database interactions.

Patchstack has provided a mitigation rule to block attacks until the plugin is updated, which can be used to detect or prevent exploitation attempts.

Specific commands or detection scripts are not provided in the available resources.

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive information stored in the website's database. Attackers could steal data, potentially leading to data breaches. The vulnerability is considered highly dangerous and could be exploited in mass campaigns targeting thousands of websites.

Compliance Impact

The SQL Injection vulnerability in the Tourfic WordPress plugin allows attackers to interact directly with the website's database and potentially steal sensitive information.

Such unauthorized access and data theft can lead to violations of data protection regulations like GDPR and HIPAA, which require the safeguarding of personal and sensitive data.

Therefore, exploitation of this vulnerability could result in non-compliance with these common standards and regulations due to compromised data confidentiality.

Mitigation Strategies

The immediate recommended step is to update the WordPress Tourfic Plugin to version 2.22.6 or later, which contains the patch for this SQL Injection vulnerability.

Until the update can be applied, use the mitigation rule provided by Patchstack to block attacks targeting this vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56064. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart