# CVE-2026-4290: WP Travel Pro unauthenticated arbitrary user deletion in REST API

Source: https://junglewise.ai/threats/cve-2026-4290-wp-travel-pro-unauthenticated-arbitrary-user-deletion-in-rest-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-29. Updated: 2026-05-29  
License: CC BY 4.0 with a link back

CVE-2026-4290 · Severity: critical · CVSS 9.1 · Published 2026-05-29

WP Travel Pro, a popular WordPress plugin for managing travel bookings and itineraries, contains a critical security flaw that allows anyone to delete user accounts. An unauthenticated attacker could use this to delete any user on the website, including administrators. This could lead to a total loss of access for site owners and significant disruption to business operations.

Vendors: [WP Travel](https://junglewise.ai/threats/vendors/wp-travel).

## Quick answers

**Is CVE-2026-4290 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-4290 being exploited in the wild.

**How severe is CVE-2026-4290?** Critical severity, with a CVSS score of 9.1, published 29 May 2026.

**Which products and versions are affected?** WP Travel Pro Up to, and including, 10.6.0.

**Is there a fix for CVE-2026-4290?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-4290 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-4290?** Check whether you run WP Travel Pro at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check in the '/wp-json/wp-travel/v1/travel-guide/{user_id}' REST API endpoint. The 'check_permission()' callback for this endpoint is hardcoded to return true, and the 'Database::delete()' method passes the provided user ID directly to the 'wp_delete_user()' function without verifying the target user's role or the requester's identity. An unauthenticated remote attacker can exploit this by sending a DELETE request to the vulnerable endpoint, specifying the ID of any user (including administrators) to remove them from the database. This vulnerability affects all versions up to and including 10.6.0.

## Affected products

- WP Travel WP Travel Pro Up to, and including, 10.6.0

## Timeline

- 2026-05-29: disclosed: Vulnerability published to NVD

## References

- [https://wptravel.io/wp-travel-pro/](https://wptravel.io/wp-travel-pro/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/885dd550-4c80-4e36-8dae-cb47c1500ea5?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/885dd550-4c80-4e36-8dae-cb47c1500ea5?source=cve)