Wptravelly EUVD-2026-20211

The CVSS 4.3 score reflects low immediate risk despite a network attack vector and low complexity. Authentication is required (PR:L in vector), reducing threat surface significantly. The vulnerability is strictly informational (C:L, I:N, A:N), permitting only confidentiality impact through data disclosure without system alteration or availability impact. EPSS at 0.02% (4th percentile) indicates minimal exploitation probability in the wild. The lack of public POC and absence from CISA KEV further suggests this is not a prioritized target for attackers. However, organizations should not dismiss this entirely: authenticated users with low privileges can exfiltrate sensitive booking data, customer information, or tour pricing - potentially valuable in competitive scenarios or for data resale. Real-world risk depends on site-specific factors: whether tour operators or administrators host sensitive customer PII, whether the site permits low-privilege user registration, and whether booking data has confidentiality value. For most small-to-medium tour operator sites, this is a medium-priority fix; for large platforms handling high-volume bookings, it warrants faster remediation.

A tour operator site permits customer registration (WordPress subscriber role). An attacker registers a low-privilege subscriber account and exploits missing authorization checks to retrieve booking details, customer contact information, and pricing strategies for competing tours via direct API calls or plugin admin pages. The attacker does not modify data but compiles a list of customer names and travel preferences for competitor intelligence or direct marketing. The attack requires valid credentials and low network complexity, making it viable for competitors with industry knowledge or users familiar with WordPress plugin structures.