Vulnerability in Travel Booking WordPress Theme Allows Unauthorized Data Modification
CVE-2024-11926

6.5MEDIUM

Key Information:

Vendor

Wordpress
Vendor
CVE Published:
18 December 2024

What is CVE-2024-11926?

The Travel Booking WordPress Theme, which is widely used for creating travel agency websites, has a significant security vulnerability categorized as CVE-2024-11926. This issue arises from inadequate capability checks on multiple sensitive functions—'st_delete_order_item', '__stPartnerCreateServiceRental', '_st_partner_approve_booking', 'save_order_item', and '__userDenyEachInfo'—which are present in all versions up to and including 3.1.6. As a result, authenticated attackers, who have at least Subscriber-level access, can exploit this vulnerability to perform unauthorized actions, including overwriting post data, deleting essential posts and pages, approving arbitrary bookings, and inserting orders at any price. This critical flaw emphasizes the need for immediate updates and comprehensive security measures to safeguard WordPress sites using this theme.

References

https://travelerwp.com/traveler-changelog/
https://www.wordfence.com/threat-intel/vulnerabilities/id...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.
CVE-2024-11926 : Vulnerability in Travel Booking WordPress Theme Allows Unauthorized Data Modification