Monthly Archives: June 2026

WordPress Tourfic Plugin <= 2.22.7 is vulnerable to a high priority SQL Injection

Posted on

Risks

CVSS 9.3

This vulnerability is highly dangerous and expected to become exploited. Vulnerabilities like this one are used in mass-exploit campaigns. Attackers use these to attack thousands of websites at a time, regardless of traffic size or popularity. Learn more.

As immediate action, update the affected plugin. If you’re unable to do so, ask your hosting provider or web developer for help.

9.3

SQL Injection

This could allow a malicious actor to directly interact with your database, including but not limited to stealing information.

CVSS score is a way to evaluate and rank reported vulnerabilities in a standardized and repeatable way but which is not ideal for WordPress.

Solutions

Update to version 2.22.8 or later.

Update to version 2.22.8 or later to resolve the vulnerability. Patchstack users can turn on auto-update for vulnerable plugins only.

Source: https://patchstack.com/database/wordpress/plugin/tourfic/vulnerability/wordpress-tourfic-ai-powered-travel-booking-hotel-booking-car-rental-wordpress-plugin-plugin-2-22-7-unauthenticated-sql-injection-vulnerability

Google Vids Personal Avatar – Maybe don’t.

Posted on

Those of us who use Gmail (or run their domain-branded email through Gmail) recently received a message from Google which starts:

“We’re preparing to release a new feature in Google Vids that will allow users to create a personal avatar using their own face and voice, safely and securely.”

They’ll be rolling it out in mid-July, as ON by default.

From a security perspective, we see a potential problem with this idea. Sure, it would be nice to be able to personalize your avatar, but considering that there’s already a problem with hackers doing deep fakes using just an image or short video or a recording of your voice, this is definitely NOT something we would recommend!

If you’re the admin of your Gmail domain you can protect your users by following these steps:

To disable access: If you want to disable personal avatars in Google Vids, you can disable the feature for the whole organization, or for specific users or groups. Complete the following steps:

  1. Go to the Google Admin console
  2. Navigate to Apps > Google Workspace > Drive and Docs > Google Vids > Personal avatars
  3. Uncheck the setting
  4. Click Save

If we (Cosmic Web Services) are admins for your Gmail-hosted email and you’d like to turn this off for your users, please let us know using our contact form or email us.

In that same vein I recently re-recorded my outgoing phone message using a free AI generated voice. And when someone calls from an unknown number (and I actually answer it instead of sending it to voicemail), I’m very cautious about what I say.

WordPress 7.0 released

Posted on

WordPress released a major update to version 7.0 on May 20th.

This was a big upgrade and included many changes and additions to the existing WordPress code. (see https://wordpress.org/download/releases/7.0/) As such, there were a lot of concerns and even some rumors that many sites would immediately break. So we were very cautious about performing the upgrade on the sites we manage!

As it turns out, all of the sites we manage did fine with the 7.0 upgrade.

But several days later, as various plugins and themes were also upgraded, some 5-6% of the sites we take care of broke. (There are always a lot of plugin and theme upgrades around the time of a new major WordPress release.)

Fortunately, we were prepared and were able to bring all those sites back online quickly!