WordPress WpTravelly plugin <= 1.7.7 - Broken Access Control vulnerability

CVE-2024-43212

Summary

A vulnerability has been identified in the WpTravelly plugin developed by MagePeople, leading to improper access control due to missing authorization checks. This issue allows users to exploit functionality that should have been constrained by Access Control Lists (ACLs), potentially compromising sensitive operations within the plugin. The vulnerability affects all versions of WpTravelly prior to and including 1.7.7, necessitating urgent attention from site administrators to ensure appropriate security measures are enforced.

References