CVE-2025-69133

Name of the Vulnerable Software and Affected Versions Tourmaster versions prior to 5.4.6

Description The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress contains a Local File Inclusion issue. This allows authenticated users with subscriber-level access or higher to include and execute arbitrary files on the server. By including files containing PHP code, an attacker can bypass access controls, retrieve sensitive information, or achieve remote code execution if they can upload files to the server.

Recommendations Update the plugin to a version newer than 5.4.5.