WP Travel Pro vulnerabilities
1 known vulnerability in WP Travel Pro from WPTravel. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
1vulnerabilities
1critical
0high
0exploited
9.1average CVSS score
Latest first
- 9.1 Critical severity
WP Travel Pro: Missing Authorization
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally