PT-2026-44859 · WordPress · Wp Travel Pro

Ren Voza · Published 2026-05-29 · Updated 2026-06-04 · CVE-2026-4290

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Travel Pro versions prior to 10.6.1

Description The plugin allows unauthenticated attackers to delete arbitrary user accounts, including administrators. This occurs via the '/wp-json/wp-travel/v1/travel-guide/{user id}' REST API endpoint because the check permission() callback unconditionally returns true and the Database::delete() method passes the user id variable directly to wp delete user() without performing role validation.

Recommendations Update to a version later than 10.6.0. As a temporary workaround, restrict access to the '/wp-json/wp-travel/v1/travel-guide/{user id}' endpoint to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4290

Affected Products

Wp Travel Pro

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4290 · Security Note
• https://reddit.com/r/StopBadBots/comments/1twww49/insane_record_145_wordpress_plugins_exposed_with · Reddit Post
• https://wptravel.io/wp-travel-pro · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/885dd550-4c80-4e36-8dae-cb47c1500ea5?source=cve · Note
• https://twitter.com/OrizonCyber/status/2060428488767603018 · Twitter Post