CVE-2025-69133

The Tourmaster plugin version 5.4.5 and earlier contains a Local File Inclusion (LFI) vulnerability exploitable by a subscriber. An authenticated user with the subscriber role can read arbitrary files on the server.

An attacker can access sensitive configuration files, passwords, or user data, leading to confidentiality breach and potential privilege escalation.

Immediately update the Tourmaster plugin to the latest available version that fixes this vulnerability. If an update is not possible, temporarily disable the plugin or restrict access to it.