Arbitrary User Deletion in WP Travel Pro Plugin for WordPress

CVE-2026-4290

What is CVE-2026-4290?

The WP Travel Pro plugin for WordPress is vulnerable, allowing arbitrary user deletion through the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint. This vulnerability stems from the check_permission() callback always returning true, and the Database::delete() method directly using the user ID in the wp_delete_user() function without verifying user roles. This flaw allows unauthenticated attackers to delete any user account, including those with administrator privileges, posing a significant risk to sites using the plugin.

References