WP Travel CVE-2026-81796

No authentication is required - the CVSS PR:N and AV:N metrics confirm unauthenticated remote exploitation from any network-reachable position against default plugin installations. The WP Travel plugin must be installed and active on a WordPress site at version 12.0.3 or earlier. No non-default configuration is specified as a prerequisite; the bypass is present in the baseline plugin deployment. Exploitation is limited by the S:U unchanged scope, meaning impact is confined to WP Travel's own data and functions - an attacker cannot use this bug alone to escalate to full WordPress administrative control or server access. No user interaction is required (UI:N).

The CVSS 7.3 score reflects a meaningful but bounded risk: network-exploitable with no authentication barrier, yet limited per-operation impact (C:L/I:L/A:L) rather than full compromise. EPSS data is absent from the provided intelligence, and the vulnerability is not listed in the CISA KEV catalog nor does any confirmed proof-of-concept exploit circulate publicly - these signals reduce the immediate operational pressure relative to the raw score. The S:U scope unchanged metric is an important limiter: an attacker cannot pivot from this bug directly into WordPress core administrative functions or the underlying server. That said, for a mid-sized travel agency IT team in mielec managing customer itineraries and payment-adjacent booking records through this plugin, even partial unauthenticated read/write access to that data represents a tangible compliance and business risk that should be treated as urgent. The AC:L metric means exploitation requires no special timing or environmental conditions, making automated scanning and bulk exploitation realistic if an exploit does emerge. Absence of KEV listing should not be mistaken for low attacker interest in WordPress plugins, which are historically high-value targets.

An unauthenticated attacker identifies a WordPress installation running WP Travel ≤ 12.0.3 via passive scanning or plugin fingerprinting, then sends a crafted HTTP request to an alternate plugin endpoint - such as a REST API route or AJAX action - that bypasses the normal authentication gate. The attacker can then read customer booking records, modify itinerary data, or disrupt availability of the travel management functionality without ever presenting valid credentials. No public POC has been confirmed, but the AC:L/PR:N vector makes automated exploitation straightforward once the bypass mechanism is known.