CVE-2026-39543

OVERVIEW CVE-2026-39543 is a missing authorization vulnerability affecting Themefic's Tourfic plugin through version 2.21.4. The flaw stems from incorrectly configured access control security levels, which could allow unauthorized users to bypass intended restrictions and gain unauthorized access to protected resources. SEVERITY The vulnerability carries a CVSS 3.1 score of 5.3 (Medium), with a network-based attack vector requiring no authentication or user interaction. The low attack complexity indicates that exploitation is straightforward. The primary impact is limited to confidentiality, allowing attackers to read sensitive information, while integrity and availability are not affected. EXPLOITATION STATUS This vulnerability does not appear to be actively exploited in the wild. It is not listed on the CISA KEV catalog and remains inactive on threat intelligence hot lists. The extremely low EPSS score of 0.00037 indicates minimal real-world exploitation probability compared to other disclosed vulnerabilities. However, the straightforward nature of the access control bypass suggests that exploitation code could potentially be developed with relative ease by threat actors if the vulnerability gains wider attention.