TuriTop Booking System

TuriTop Booking System has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2025; all 2 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2025 was the busiest year with 2 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (50%). Other recurring categories include Missing Authorization.

Every one of the 2 issues recorded for TuriTop Booking System has a vendor fix available, so running the current release closes all known holes.

2 independent researchers contributed these findings, one record each. TuriTop Booking System is installed on roughly 600 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.6/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all TuriTop Booking System vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-32571

TuriTop Booking System <= 1.0.11 - Authenticated (Subscriber+) PHP Object Injection

Read the full analysis

Vulnerability Records

2 records
TuriTop Booking System banner
Latestv1.0.21

TuriTop Booking System

TuriTop

Author

TuriTop

5.0(2)
100/100
Last Updated
2026-08-21 (23d ago)
Active Installs
600+
Downloads
7,953
Requires WP
5.9+
Requires PHP
7.0+
Tested up to
WP 7.1
Created
2017-03-14 (10y ago)

TuriTop Booking System connects your WordPress website to your TuriTop account, allowing visitors to check real-time availability and book tours, activities, attractions and experiences directly from your site. The plugin adds a responsive booking interface that works on desktop, tablet and mobile. Customers can choose a date and time, enter their details, apply promotional codes and pay online without leaving your website. Add TuriTop to any page or post using the Gutenberg block or a shortcode. The booking widget can be placed alongside the images and descriptions already published on your website, helping you turn your existing content into a direct booking channel. Plugin features Real-time availability and online booking. Gutenberg block and shortcode support. Responsive booking interface for desktop and mobile devices. Product and service synchronisation with your TuriTop account. Support for promotional codes and online payments. Booking data managed securely through TuriTop and kept separate from your WordPress database. More than a WordPress booking plugin TuriTop is an online booking and management platform built for tours, activities, attractions, events and other experience-based businesses. Depending on your TuriTop plan and configuration, you can also: Centralise bookings, schedules, availability, capacity and resources. Accept payments through gateways such as Stripe, PayPal, Redsys, Bizum and others. Connect with leading OTAs such as GetYourGuide, Viator, Civitatis, Tiqets, Musement and Headout through TuriTop’s Channel Manager. Automatically synchronise availability across your website and connected OTAs to reduce manual work and prevent overbookings. Manage bookings from your website, OTAs and distribution partners from one central platform. Offer your booking process in multiple languages and currencies. Personalise customer emails and automate booking reminders. Connect booking data with Google Calendar and Google Sheets. Integrate with tools such as Google Tag Manager and Meta Pixel. Validate bookings and tickets using TuriTop’s mobile check-in app. Connect with other tourism businesses through the TuriTop B2B Marketplace. A TuriTop account is required to use this plugin. Start your 14-day free trial or book a personalised demo to discover how TuriTop can help you sell online and manage your bookings from one place. External services This plugin relies on the TuriTop booking service (app.turitop.com) to function. TuriTop is the online booking platform that provides the booking widget and manages your products, availability, promotions and bookings. A TuriTop account is required to use this plugin. What the service is used for and what data is sent: Authorization: when you connect or renew the connection, the plugin sends your TuriTop account authorization (API key/token) to authenticate the site against your TuriTop account. Product synchronization: when you synchronise services or load the configuration, the plugin sends product/service identifiers and the requested language to retrieve your products, tours, events and availability. Promotions: when a visitor enters a promo code, the code is sent to validate it. Bookings: when a visitor makes or edits a booking through the embedded widget, the booking details are sent to TuriTop to create or update the booking. These requests are made to https://app.turitop.com each time the relevant admin synchronization runs or the booking widget is loaded by a site visitor. Service provided by TuriTop S.L.: Terms of Service: https://www.turitop.com/en/terms-conditions Privacy Policy: https://www.turitop.com/en/privacy-policy Source Code and Third-Party Libraries All of this plugin’s own code is shipped human-readable and non-obfuscated. The complete, publicly accessible source is the WordPress.org Subversion repository for this plugin: https://plugins.svn.wordpress.org/turitop-booking-system/ — every released file (trunk and tags) can be browsed and downloaded there without authentication. Some assets bundle third-party open-source libraries. Their original, non-obfuscated sources are available at the URLs below: iframe-resizer — by David J. Bradshaw. A minified copy is bundled inside assets/js/load-turitop.js (used to resize the embedded TuriTop booking widget iframe). Source: https://github.com/davidjbradshaw/iframe-resizer wp-color-picker-alpha (version 3.0.4) — located in vendor/integralwebsite-lib/js/alpha/ (adds alpha-channel support to the WordPress color picker in the admin settings). Source: https://github.com/kallookoo/wp-color-picker-alpha Configuration Create your TuriTop account . Configure your account and services on TuriTop. If you need any help, please do not hesitate to request a live demo and we will show you how TuriTop works. Create a WordPress Post and embed the TuriTop Booking System by using the gutenberg block “TuriTop Booking System”, our WooCommerce integration or the shortcodes. Suggestions If you have suggestions about how to improve TuriTop Booking System, you can write us so we can bundle them into the next release of the plugin.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C