Executive brief
The Tourmaster plugin for WordPress, which is used for managing tours and bookings, contains a security flaw that allows an attacker to hijack an administrator's session. By tricking a logged-in administrator into clicking a malicious link, an attacker can inject harmful scripts into the website's management area. This could lead to unauthorized changes to the site, theft of sensitive administrative data, or full site takeover.
Technical details
The tourmaster plugin for WordPress is vulnerable to a combination of Cross-Site Request Forgery (CSRF) and Stored Cross-Site Scripting (XSS) in versions prior to 5.4.8. The root cause is a lack of cryptographic nonce validation when processing request parameters for custom-filter labels, combined with a failure to sanitize or escape these labels when they are rendered on the filter administration page. An unauthenticated remote attacker can exploit this by crafting a malicious request and inducing an authenticated administrator to trigger it (e.g., via social engineering). Successful exploitation allows the attacker to inject arbitrary JavaScript into the administrative interface, potentially leading to session hijacking or administrative account takeover. The issue is resolved in version 5.4.8.
Affected products
- Goodlayers tourmaster < 5.4.8
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD publication date
- 2026-07-13: patched: Fixed version 5.4.8 released