Travelfic Toolkit
Monthly
Broken access control in the Travelfic Toolkit WordPress plugin (versions <= 1.5.1) permits subscriber-level authenticated users to execute privileged operations without proper authorization enforcement, yielding high integrity and availability impact on the affected installation. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails entirely to verify whether a requesting user holds the necessary capabilities before processing sensitive actions. No public exploit code and no active exploitation have been identified at time of analysis.
Broken access control in the Travelfic Toolkit WordPress plugin (versions <= 1.5.1) permits subscriber-level authenticated users to execute privileged operations without proper authorization enforcement, yielding high integrity and availability impact on the affected installation. The flaw is classified as CWE-862 (Missing Authorization), meaning the plugin fails entirely to verify whether a requesting user holds the necessary capabilities before processing sensitive actions. No public exploit code and no active exploitation have been identified at time of analysis.