CVE-2026-4290: WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators
The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{userid} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the checkpermission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wpdeleteuser() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-travel-proto a version that resolves this vulnerability.Fixed in 10.6.0 - Configuration
Update the endpoint authorization logic so the check_permission() callback does NOT unconditionally return true; enforce proper authorization for the requester before allowing any user deletion.
WP Travel Pro REST API endpoint (/wp-json/wp-travel/v1/travel-guide/{user_id}) check_permission() callback = return true - Configuration
Modify Database::delete() so it does not pass the {user_id} directly to wp_delete_user() without role validation; add checks to ensure the requester is authorized to delete the specific target user and validate roles accordingly.
WP Travel Pro user deletion logic (Database::delete()) User ID validation / role validation before wp_delete_user() = pass user ID directly to wp_delete_user() without role validation - Compensating control
Restrict access to the vulnerable REST API endpoint (/wp-json/wp-travel/v1/travel-guide/{user_id}) using network/WAF/ACL controls to prevent unauthenticated access until the plugin is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4290?
The severity of CVE-2026-4290 is critical with a score of 9.1.
How do I fix CVE-2026-4290?
To fix CVE-2026-4290, update the WP Travel Pro plugin to version 10.6.1 or later.
What is the impact of CVE-2026-4290?
CVE-2026-4290 allows unauthenticated users to delete any user, including administrators, through a vulnerable API endpoint.
Which versions are affected by CVE-2026-4290?
CVE-2026-4290 affects all versions of WP Travel Pro up to and including 10.6.0.
What component is vulnerable in CVE-2026-4290?
The vulnerable component in CVE-2026-4290 is the check_permission() callback in the WP Travel Pro plugin's API.