Travelpayouts WordPress Plugin Missing Authorization Vulnerability Allowing Broken Access Control

A missing authorization vulnerability has been identified in the Travelpayouts WordPress plugin, specifically in versions through 1.2.1. This vulnerability arises from incorrectly configured access control security levels, allowing unprivileged users to perform actions reserved for higher privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized users gaining access to functions or actions that require higher privileges, potentially allowing them to manipulate content or settings inappropriately.

Remediation

Users of the Travelpayouts WordPress plugin are advised to upgrade to the latest version. For those seeking immediate protection, Patchstack offers a mitigation rule that can be applied until an official patch is available.