WPTravel vulnerabilities
We track 1 vulnerability in WPTravel products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on May 29, 2026.
1vulnerabilities
1critical
0high
0exploited
9.1average CVSS score
Latest WPTravel vulnerabilities
- 9.1 Critical severity
WP Travel Pro: Missing Authorization
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally