What is the CVSS score of CVE-2026-4290?

CVE-2026-4290 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WP Travel Pro are affected by CVE-2026-4290?

WP Travel Pro WordPress plugin (versions through 10.6.0) contains a critical vulnerability allowing unauthenticated remote deletion of any user account, including administrator accounts.

How to fix or mitigate CVE-2026-4290?

24 hours: Immediately deactivate or uninstall WP Travel Pro versions ≤10.6.0; audit WordPress user deletion logs for unauthorized activity. 7 days: Complete evaluation and testing of alternative travel booking plugins; deploy WAF rules blocking plugin REST API endpoints. 30 days: Finalize plugin replacement or validate and maintain all compensating control implementations.

WP Travel Pro CVE-2026-4290

EUVD-2026-33327 CRITICAL

Missing Authorization (CWE-862)

2026-05-29 Wordfence

GHSA-3r5v-r3c5-jj73

WordPress Authentication Bypass

9.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

May 29, 2026 - 15:15 vuln.today

CVE Published

May 29, 2026 - 14:29 nvd

CRITICAL 9.1

DescriptionCVE.org

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() callback unconditionally returning true and the Database::delete() method passing the user ID directly to wp_delete_user() without any role validation. This makes it possible for unauthenticated attackers to delete arbitrary user accounts, including those of administrators.

AnalysisAI

Unauthenticated arbitrary user deletion in the WP Travel Pro WordPress plugin (versions through 10.6.0) allows remote attackers to delete any WordPress account, including administrators, via an exposed REST API endpoint. The flaw stems from a broken permission callback combined with missing role validation, producing a CVSS 9.1 integrity/availability impact. No public exploit identified at time of analysis, but the trivial nature of the bug and Wordfence's disclosure make weaponization straightforward for any actor reading the advisory.

Technical ContextAI

WP Travel Pro is a commercial travel-booking plugin from WP Travel (wptravel.io) for WordPress, deployed by tour operators and travel agencies. The vulnerability is rooted in CWE-862 (Missing Authorization): the plugin registers a REST route at /wp-json/wp-travel/v1/travel-guide/{user_id} whose check_permission() callback unconditionally returns true, effectively disabling WordPress's permission_callback security model that is supposed to gate REST endpoints. Compounding this, the internal Database::delete() helper passes the supplied user_id straight to WordPress core's wp_delete_user() function without verifying the caller's capability (e.g., delete_users) or the target's role, so any user ID - including ID 1 (typically the site administrator) - can be removed. The affected CPE is cpe:2.3:a:wptravel:wp_travel_pro:*:*:*:*:*:*:*:* covering all versions up to and including 10.6.0.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied references; site owners should monitor https://wptravel.io/wp-travel-pro/ and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/885dd550-4c80-4e36-8dae-cb47c1500ea5?source=cve for a fixed release above 10.6.0 and upgrade as soon as one is published. In the interim, block or restrict access to the /wp-json/wp-travel/v1/travel-guide/ route at the web server, WAF, or via a must-use plugin that filters rest_pre_dispatch - this prevents the deletion path but will also break any legitimate travel-guide management workflow that depends on that endpoint. If the travel-guide feature is not in active use, deactivating WP Travel Pro entirely is the safest mitigation; sites that must keep it active should additionally take a fresh database backup and enumerate existing administrator accounts so any deletion can be quickly detected and the account restored.