Unauthorized Data Modification in WP Travel Engine Plugin for WordPress
CVE-2024-10606

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Vendor
CVE Published:
23 November 2024

What is CVE-2024-10606?

The WP Travel Engine Plugin, used for tour bookings on WordPress, is susceptible to unauthorized data modification due to inadequate capability checks in the wpte_onboard_save_function_callback() function. This vulnerability affects all versions up to and including 6.2.1. Authenticated attackers with contributor-level access can exploit this flaw to alter important settings, posing risks such as loss of revenue and unauthorized page updates, potentially compromising the integrity of the website.

Affected Version(s)

WP Travel Engine – Tour Booking Plugin – Tour Operator Software 0 <= 6.2.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3193913/wp-t...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.