{"id":"CVE-2026-4290","aliases":["EUVD-2026-33327","GHSA-3r5v-r3c5-jj73"],"status":"published","title":"WP Travel Pro \u003c= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators","description":"The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00258,"percentile":0.17646,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-05-29T14:29:08Z","modified":"2026-07-21T12:10:00Z","products":[{"vendor":"wptravel","product":"wp travel pro"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/885dd550-4c80-4e36-8dae-cb47c1500ea5?source=cve"},{"url":"https://wptravel.io/wp-travel-pro/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-4290"},{"url":"https://wptravel.io/wp-travel-pro"},{"url":"https://github.com/advisories/GHSA-3r5v-r3c5-jj73"}],"sources":{"cve":[{"id":"CVE-2026-4290","title":"WP Travel Pro \u003c= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators","description":"The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.","status":"published","published":"2026-05-29T14:29:08.134Z","modified":"2026-05-29T15:03:55.782Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:19:58.944663Z"}],"euvd":[{"id":"EUVD-2026-33327","description":"The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.","status":"published","published":"2026-05-29T14:29:08Z","modified":"2026-05-29T15:03:55Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:21:00.772434Z"}],"ghsa":[{"id":"GHSA-3r5v-r3c5-jj73","title":"The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json...","description":"The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.","status":"published","published":"2026-05-29T15:30:35Z","modified":"2026-05-29T15:30:43Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:08:22.826978Z"}],"nvd":[{"id":"CVE-2026-4290","description":"The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.","status":"published","published":"2026-05-29T15:16:24.893Z","modified":"2026-07-21T12:10:00.09Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:21.244426Z"}]}}