Executive brief
WP Travel Pro, a popular WordPress plugin for managing travel bookings and itineraries, contains a critical security flaw that allows anyone to delete user accounts. An unauthenticated attacker could use this to delete any user on the website, including administrators. This could lead to a total loss of access for site owners and significant disruption to business operations.
Technical details
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check in the '/wp-json/wp-travel/v1/travel-guide/{user_id}' REST API endpoint. The 'check_permission()' callback for this endpoint is hardcoded to return true, and the 'Database::delete()' method passes the provided user ID directly to the 'wp_delete_user()' function without verifying the target user's role or the requester's identity. An unauthenticated remote attacker can exploit this by sending a DELETE request to the vulnerable endpoint, specifying the ID of any user (including administrators) to remove them from the database. This vulnerability affects all versions up to and including 10.6.0.
Affected products
- WP Travel WP Travel Pro Up to, and including, 10.6.0
Timeline
- 2026-05-29: disclosed: Vulnerability published to NVD