The WP Travel Engine plugin for WordPress is vulnerable to an authorization bypass flaw that permits unauthorized access, posing a high risk to site integrity and data security.

This vulnerability is a missing authorization flaw (CWE-862) within the plugin's AJAX controllers and form field handling. It allows unauthenticated users to trigger sensitive functions that should be restricted to authorized personnel.

A successful exploit allows unauthorized access to plugin functionality, which may lead to sensitive data exposure or unauthorized configuration changes. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent potential service disruption or malicious manipulation of booking records.

Immediate Action: Update the WP Travel Engine plugin to version 6.8.5 or later immediately.

Proactive Monitoring: Monitor server access logs for anomalous requests targeting the /includes/classes/Core/Controllers/Ajax/ directory or unusual POST requests to plugin-related endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious AJAX requests or unauthorized attempts to access administrative plugin endpoints.

Public Exploit Available: Unknown

The high CVSS score reflects the ease of exploitation for this authorization bypass. Administrators must verify their plugin version and apply the 6.8.5 update as soon as possible to neutralize this risk.