Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin

Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin has 14 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 14 are fixed as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 4 high. 2024 was the busiest year with 7 disclosures.

The most common weakness is Missing Authorization, behind 5 of the records (36%). Other recurring categories include SQL Injection, Cross-Site Scripting.

Every one of the 14 issues recorded for Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (4) reported by LVT-tholv2k.

Strategic Overview

Avg CVSSMedium

6.1/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-29136

Tourfic <= 2.11.17 - Authenticated (Subscriber+) PHP Object Injection

Read the full analysis

Vulnerability Records

14 records


2026-08-11 00:00	Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization Tourfic <= 2.23.1	`CVE-2026-27999`	4.3 Medium	Artus KG	Yes
2026-07-08 00:00	Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization Tourfic <= 2.22.5	`CVE-2026-57392`	5.3 Medium	Ramshath	Yes
2026-07-08 00:00	Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization Tourfic <= 2.22.5	`CVE-2026-57395`	4.3 Medium	Sandesh Gawai	Yes
2026-06-25 00:00	Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Authenticated (Subscriber+) SQL Injection Tourfic <= 2.22.5	`CVE-2026-56064`	6.5 Medium	anhcd05	Yes
2026-06-24 18:36	Tourfic <= 2.22.7 - Unauthenticated SQL Injection via 'post_id' Parameter Tourfic <= 2.22.7	`CVE-2026-12937`	7.5 High	Wordfence PRISM	Yes
2026-03-28 00:00	Tourfic <= 2.21.4 - Missing Authorization Tourfic <= 2.21.4	`CVE-2026-39543`	5.3 Medium	Bao - BlueRock	Yes
2025-01-24 00:00	Tourfic <= 2.15.3 - Authenticated (Admin+) Arbitrary File Upload Tourfic <= 2.15.3	`CVE-2025-24650`	7.2 High	I8BL	Yes
2024-12-24 00:00	Tourfic – Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin \| WooCommerce Booking <= 2.15.3 - Authenticated (Subscriber+) SQL Injection Tourfic <= 2.15.3	`CVE-2024-12032`	6.5 Medium	Thái An	Yes
2024-09-13 00:00	Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions Tourfic <= 2.14.5	`CVE-2024-8860`	4.3 Medium	Anonymous	Yes
2024-08-29 00:00	Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions Tourfic <= 2.11.20	`CVE-2024-8319`	4.3 Medium	Anonymous	Yes

Showing 1–10 of 14 reports