Travel Agency EUVD-2026-11831

The vulnerability stems from CWE-862 (Missing Authorization), a class of access control flaws where the application fails to enforce proper privilege levels or role-based access controls before allowing sensitive operations. In this case, the raratheme Travel Agency plugin (a WordPress or similar content management system extension) does not validate user permissions before processing data modification requests, likely in REST API endpoints or form handlers. The affected versions through 1.5.5 lack proper capability checks (or equivalent authorization middleware) that should restrict administrative or data-modifying operations to authenticated and authorized users. The CPE identifier would typically be structured as cpe:2.3:a:raratheme:travel-agency, though the specific CPE string requires vendor confirmation. This is a common misconfiguration in plugin development where developers expose functionality without wrapping it in authorization checks.