Travel Agency CVE-2026-32346

The CVSS 3.1 score of 5.3 reflects a Medium-severity vulnerability with network attack vector, low attack complexity, no privileges required, and no user interaction—meaning any remote user can exploit this without special conditions. However, the impact is limited to integrity (the 'I:L' component), with no confidentiality or availability breach, reducing the severity below 'High'. The EPSS (Exploitation Prediction Scoring System) score is likely moderate, as the exploit requires only network access and the vulnerability is a well-known misconfiguration pattern; however, without public POC or active KEV designation, real-world exploitation may be limited. From an SSVC perspective, the exploitation status is likely 'unproven' (no public POC), automatable (no multi-step social engineering or user interaction needed), and technical impact is 'moderate' (data modification but not system-wide compromise). The real-world priority is medium to high for Travel Agency installations processing sensitive booking or customer data, but lower for installations not directly exposed to the internet or with proper Web Application Firewall (WAF) rules.

An unauthenticated attacker discovers the Travel Agency plugin is installed on a public-facing WordPress site and identifies an exposed API endpoint (e.g., /wp-json/travel-agency/v1/bookings or a form handler) that modifies booking records. Due to the missing authorization check, the attacker sends a crafted HTTP POST request directly to this endpoint with modified booking data (such as changing the price or customer details of an existing reservation), and the plugin processes the request without verifying the attacker's identity or permissions, allowing the data modification to succeed. No user interaction or special privileges are required; the attack is entirely automated and repeatable via simple curl or Postman requests.