CVE-2025-5282CWE-862

WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

High · published June 13, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
21.2
In the wild
Unconfirmed
What it is

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it possible for unauthenticated attackers to delete arbitrary posts.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00296 · 21.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-06-13T03:41Z
EPSS history
Timeline
  • 13 JUN 03:41Z
    WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
    cvelistv5