WP Travel Pro Missing Authorization Vulnerability Allowing Unauthenticated User Deletion

A vulnerability in the WP Travel Pro plugin for WordPress, present in all versions through 10.6.0, allows for arbitrary user deletion via the REST API. The issue arises because the permission check always returns true, and the user ID is passed directly to the user deletion function without validating roles. This flaw enables unauthenticated attackers to delete any user account, including those of administrators.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of user accounts, including administrators.