Tourmaster WordPress Plugin Sensitive Data Exposure

Executive Summary

The tourmaster WordPress plugin before version 5.4.9 has a flaw where it exports order and booking data to a fixed, predictable file in a publicly accessible directory without proper access controls. This allows unauthenticated users to download the exported file containing customers' personal information once an administrator runs an export.

Useful 0 Not Useful 0

Detection Guidance

Check for the existence of the predictable export file in the plugin's directory, typically named something like 'tourmaster_export_[timestamp].csv' or similar. You can use commands like 'find /path/to/wordpress -name "tourmaster_export_*.csv"' to locate it. If the file exists and is accessible without authentication, the vulnerability is present.

Useful 0 Not Useful 0

Impact Analysis

Unauthenticated attackers could access and download sensitive customer data such as personal information if an administrator runs an export. This could lead to data breaches, identity theft, or other malicious activities using the exposed data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could result in non-compliance with GDPR, HIPAA, and other privacy regulations due to unauthorized access and exposure of personal data. Organizations may face legal penalties, fines, and reputational damage for failing to protect sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Tourmaster plugin to version 5.4.9 or later immediately. If an update is not available, disable the plugin temporarily until a patch is released. Review any existing export files for unauthorized access and remove them if found.

Useful 0 Not Useful 0