An unauthenticated authorization bypass vulnerability in the WP Travel Engine plugin allows remote attackers to modify site settings, potentially leading to full site compromise.

This is a missing authorization flaw (CWE-862) occurring within an AJAX action. The vulnerability allows unauthenticated users to invoke an option-updating function because the public nonce required to gate the action is exposed to anonymous visitors.

Successful exploitation of this vulnerability permits an unauthenticated attacker to alter site-wide settings within the WP Travel Engine plugin. Given the CVSS score of 7.5, this high-severity flaw could lead to unauthorized administrative modifications, potential redirection of booking traffic, or other service disruptions. Such unauthorized access poses a significant risk to the integrity of business operations and customer data managed through the booking platform.

Immediate Action: Update the WP Travel Engine plugin to version 6.8.2 or later immediately to apply the necessary capability checks.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at the plugin AJAX endpoints, particularly those originating from unauthorized IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the vulnerable AJAX action endpoints until the update can be applied.

Public Exploit Available: No (Exploit available: unknown)

The vulnerability presents a clear risk to site integrity and administrative control. IT administrators must prioritize updating the WP Travel Engine plugin to version 6.8.2 to remediate the authorization bypass. Delaying this patch leaves the application exposed to unauthorized configuration changes by unauthenticated remote actors.