WP Travel Engine
Moderate fix1 remedy
cpe:2.3:a:wptravelengine:wp_travel_engine:*:*:*:*:wordpress:*:*
Moderate fix1 remedy
- <= 6.5.1
WP Travel Engine Tour Booking Plugin Missing Authorization Vulnerability Allowing Unauthenticated Post Deletion
Vulnerability
Patched
A vulnerability exists in the WP Travel Engine Tour Booking Plugin for WordPress, specifically in versions through 6.5.1. The issue arises from a missing capability check in the delete_package() function, which allows unauthenticated attackers to delete arbitrary posts, leading to unauthorized data loss.
Impact
Exploitation of this vulnerability allows for unauthorized deletion of posts, potentially leading to loss of important data or content.
Remediation
Users are advised to update the WP Travel Engine Tour Booking Plugin to version 6.5.2 or a newer patched version.
Added: Sep 1, 2025, 7:22 PM
Updated: Sep 1, 2025, 7:22 PM
Vulnerability Rating
Custom Algorithm
spread
3.4impact
0.6exploitability
8.2remediation
7.7relevance
0.2threat
3.2urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.