CVE-2026-56064 is a SQL Injection vulnerability in Themefic's Tourfic plugin affecting versions up to 2.22.5. The flaw involves improper neutralization of special elements in SQL commands, allowing an attacker with network access and low privileges to execute crafted SQL queries. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity with network attack vector, low attack complexity, no user interaction, and a scope change. The impact includes high confidentiality compromise and low availability impact. No official patch or remediation level has been published by the vendor as of the current data.

Successful exploitation could allow an attacker to access sensitive database information (high confidentiality impact) without requiring user interaction. The attack complexity is low, and the attacker needs only low privileges. The vulnerability also causes a low impact on availability, potentially leading to partial denial of service conditions. Integrity impact is not indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting network access to the affected application and monitor for suspicious activity related to SQL injection attempts. Avoid exposing the vulnerable plugin to untrusted networks.