CVE-2024-10606

MEDIUM

WP Travel Engine < 6.2.1 - Authenticated Data Modification via wpte_onboard_save_function_callback

Title source: llm

Description

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpte_onboard_save_function_callback() function in all versions up to, and including, 6.2.1. This makes it possible for authenticated attackers, with contributor-level access and above, to modify several settings that could have an impact such as lost revenue and page updates.

References (2)

Core 2

Core References

Patch

https://plugins.trac.wordpress.org/changeset/3193913/wp-travel-engine/tags/6.2.2/includes/class-wp-travel-engine-onboard.php

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/c91d1ec0-0430-4ddd-b6b1-25af0b5cea9d?source=cve

Scores

CVSS v3 4.3

EPSS 0.0030

EPSS Percentile 21.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

wptravelengine/WP Travel Engine – Tour Booking Plugin – Tour Operator Software < 6.2.1

wptravelengine/wp_travel_engine < 6.2.2

Published Nov 23, 2024

Tracked Since Feb 18, 2026