CVE-2026-4290
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The WP Travel Pro plugin for WordPress up to version 10.6.0 is vulnerable to unauthorized user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint. The check_permission() callback unconditionally returns true and the Database::delete() method passes the user ID directly to wp_delete_user() without role validation.
Risk Assessment
An unauthenticated attacker can delete arbitrary user accounts, including administrators, leading to a complete loss of control over the WordPress site.
Recommendation
Immediately update the WP Travel Pro plugin to the latest available version that fixes this vulnerability. If no update is available, temporarily disable the plugin or block access to the REST API endpoint.
Original NVD description (English source)
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.