Travelfic Toolkit EUVD-2026-57964

Exploitation requires an authenticated WordPress session at subscriber level or higher (confirmed by PR:L in the CVSS vector). On sites with open user registration, an attacker self-registers at no cost; on sites with registration disabled, the attacker must first compromise or socially engineer an existing low-privilege account, which meaningfully raises the bar. No specific non-default plugin configuration is stated as a prerequisite - the vulnerability appears to be present in the default installed state of affected versions. The high integrity and availability impact (I:H/A:H) indicates unauthorized write or destructive operations are possible, while the absence of confidentiality impact (C:N) means read-access to protected data is not part of the attack surface confirmed by the CVSS vector. Disabling the plugin or restricting authenticated access to the WordPress installation are the primary limiting factors for defenders.

The CVSS 8.1 score reflects a genuinely significant risk profile: AV:N and AC:L confirm the endpoint is network-reachable and requires no special conditions, while I:H and A:H indicate that content integrity and site availability are both fully compromisable. The single meaningful barrier to exploitation is the PR:L requirement - a subscriber-level account - which is trivially bypassed on any WordPress installation with open user registration enabled. No EPSS score was included in the provided intelligence, so quantitative exploitation probability cannot be assessed numerically; however, the low technical complexity means that even a mid-sized travel agency IT team in walbrzych should treat this as urgent if their site permits public account creation. There is no CISA KEV listing and no known public proof-of-concept, which modestly reduces near-term mass-exploitation risk, but the attack class (broken access control on a low-privilege role) is well understood and replication from description alone is straightforward. The absence of confidentiality impact (C:N) limits data-exfiltration scenarios but does not diminish the real threat of unauthorized content modification or disruption.

An attacker registers a free subscriber account on the target WordPress site - possible on any site with open registration enabled - and authenticates normally. The attacker then sends a crafted HTTP POST or REST request to one of the plugin's unprotected endpoints, omitting no special tooling beyond a browser or curl, and executes a privileged action such as modifying, publishing, or deleting content. No public proof-of-concept has been identified, but the attack technique requires no specialized knowledge beyond familiarity with WordPress AJAX mechanics.