CVE-2024-10606: WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpteonboardsavefunctioncallback() function in all versions up to, and including, 6.2.1. This makes it possible for authenticated attackers, with contributor-level access and above, to modify several settings that could have an impact such as lost revenue and page updates.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10606?
The severity of CVE-2024-10606 is considered high due to the potential for unauthorized data modification.
How do I fix CVE-2024-10606?
To fix CVE-2024-10606, update the WP Travel Engine plugin to version 6.2.2 or later.
What versions are affected by CVE-2024-10606?
All versions of the WP Travel Engine plugin up to and including 6.2.1 are affected by CVE-2024-10606.
What kind of vulnerability is CVE-2024-10606?
CVE-2024-10606 is an unauthorized modification of data vulnerability due to a missing capability check.
Who is impacted by CVE-2024-10606?
Users of the WP Travel Engine plugin for WordPress are impacted by CVE-2024-10606 if they are using affected versions.