Travel Booking CVE-2026-32486

The risk assessment reveals a moderate but actionable threat despite the seemingly low CVSS score. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a highly accessible attack surface: network-accessible, low attack complexity, and critically, no privileges required (PR:N) with no user interaction necessary. However, the confidentiality impact is none (C:N) and availability impact is none (A:N), limiting the scope to integrity violations (I:L). The CVSS 5.3 reflects this medium-integrity-only impact. From an SSVC perspective, this vulnerability presents automatable exploitation potential given the network access vector and lack of authentication requirements, which would elevate priority for organizations using Travel Booking. The absence of complexity factors and privilege requirements makes this a practical exploitation target, particularly concerning for travel agencies and booking platforms storing sensitive customer reservation data. Organizations should prioritize patching this vulnerability above other lower-CVSS issues that require authentication or user interaction.

An unauthenticated attacker could directly access the Travel Booking plugin's API endpoints or administrative functions without providing valid credentials due to missing authorization checks. For example, by crafting HTTP requests to endpoints such as those handling booking creation, modification, or cancellation, the attacker could directly manipulate travel reservations, alter booking details, or gain visibility into customer information without authentication. Since the attack vector is network-based with low complexity and requires no user interaction, the attacker could automate this process to extract booking data or sabotage reservations at scale, making this particularly damaging for production travel booking platforms.