Brief Summary: CVE-2026-4290 in WP Travel Pro — Unauthenticated Admin Deletion via Broken REST API Authorization

Introduction

A single unauthenticated HTTP DELETE request can permanently remove any WordPress user account, including every administrator, on sites running the WP Travel Pro plugin. CVE-2026-4290, disclosed on May 28, 2026 with a CVSS score of 9.1, is a missing authorization flaw at its most basic. A destructive REST API endpoint has no access control at all.

WP Travel Pro is a commercial WordPress plugin for travel agencies and tour operators. It handles booking management, payment gateway integrations, and travel guide features. The free version of WP Travel has over 4,000 active installations on WordPress.org, and the vendor claims over 6,000 websites powered worldwide. WP Travel is not the largest WordPress travel plugin, but it holds a meaningful niche, particularly among trekking and tour operators in South and Southeast Asian markets.

No patch is available as of May 29, 2026.

Technical Information

Vulnerability Classification

CVE-2026-4290 is classified under CWE-862 (Missing Authorization), which MITRE defines as a weakness where "the product does not perform an authorization check when an actor attempts to access a resource or perform an action." CWE-862 is a Class-level weakness and a direct child of CWE-285 (Improper Authorization), which sits under the Pillar weakness CWE-284 (Improper Access Control). CWE-862 consistently ranks in the CWE Top 25 Most Dangerous Software Weaknesses, a sign of how common it is across the software industry.

The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. Component by component:

Root Cause Analysis

Two implementation failures in the WP Travel Pro plugin's REST API layer combine to produce the vulnerability.

Flaw 1: Unconditional Permission Bypass. The plugin registers a REST API route at /wp-json/wp-travel/v1/travel-guide/{user_id} and assigns a check_permission() method as the permission callback. In the WordPress REST API, the permission callback decides whether a request may proceed. Here, check_permission() returns true for every request, whatever the requester's authentication status or role. The endpoint therefore has no access control, and any anonymous visitor on the internet can reach it.

Flaw 2: Unvalidated User Deletion. When a DELETE request reaches the endpoint, the Database::delete() method takes the {user_id} parameter from the URL path and passes it straight to the WordPress core function wp_delete_user(), with no role validation or authorization check. The wp_delete_user() function is one of the most destructive operations in the WordPress API: it permanently removes a user account and either reassigns or deletes all content that user authored.

Together, the two flaws give the public internet a direct, unprotected path to a core WordPress administrative function.

Attack Flow

Exploiting CVE-2026-4290 is straightforward:

1. Target Identification. The attacker probes a WordPress site for the WP Travel Pro REST API namespace by requesting /wp-json/wp-travel/v1/. If travel guide routes are present, the plugin is active.

2. User Enumeration and Deletion. WordPress user IDs are typically sequential integers starting from 1, and user ID 1 is almost always the original administrator account. The attacker sends an HTTP DELETE request to the vulnerable endpoint:

DELETE /wp-json/wp-travel/v1/travel-guide/1

Because check_permission() returns true unconditionally, the request goes through unchallenged. The Database::delete() method calls wp_delete_user(1) and permanently deletes the administrator account.

3. Mass Deletion. The attacker steps through sequential user IDs (/travel-guide/2, /travel-guide/3, etc.) and deletes every user account on the site. At no point does the attacker need an authentication token, cookie, nonce, or password.

4. Site Takeover. Once every administrator account is gone, legitimate administrators can no longer get into the WordPress installation. If WordPress registration is enabled (the default on many sites), the attacker can register a new account. Depending on the site's configuration and any remaining user accounts, the attacker may be able to escalate to administrative privileges and take full control of the site.

A simple loop with curl or any HTTP client can run the entire attack. Low complexity and high impact make this vulnerability particularly attractive for automated exploitation campaigns.

Comparison to Similar Vulnerabilities

Structurally, this vulnerability resembles other recent WordPress plugin authorization failures. The Burst Statistics authentication bypass (CVSS 9.8, affecting 200,000+ sites) and the Perfmatters arbitrary file deletion (also affecting 200,000+ sites) both involved permission callbacks that failed to enforce authorization. CVE-2026-4290 is arguably more severe in one respect. It goes straight at the administrative control plane by deleting user accounts, where those flaws targeted files or created accounts. Deleting all administrators is both a denial of service and a precondition for site takeover.

Affected Systems and Versions

The free WP Travel plugin (available on WordPress.org, currently at version 11.6.0) has its own codebase and release cycle, separate from WP Travel Pro. The changelog for the free plugin's version 11.6.0 mentions "audited AJAX requests and added appropriate security validations," but the audit appears to have covered only the free plugin and its AJAX endpoints, and to have left the REST API in the Pro version unaddressed.

WordPress.org does not publicly track WP Travel Pro installations, because it is a commercial plugin distributed through wptravel.io. The exact number of affected sites is unknown, though the vendor claims over 6,000 websites powered worldwide across the free and Pro versions combined.

Vendor Security History

WP Travel has a documented pattern of authorization-related vulnerabilities, which suggests systemic problems with how it implements access control:

Within a single year, WP Travel went from a medium-severity authorization bypass in the free plugin (CVE-2026-24568) to a critical unauthenticated admin deletion in the Pro plugin (CVE-2026-4290). The free plugin got a security audit, which produced the hardened AJAX handling in version 11.6.0. The Pro plugin's REST API authorization stayed fundamentally broken through version 10.6.0.

The wider WordPress travel plugin category also has a disproportionate share of security issues. The related but separate WP Travel Engine plugin (from a different vendor) has had CVE-2025-7634 (Local File Inclusion) and CVE-2026-2437 (CVSS 6.4), among others.

Mitigation Recommendations

No patch exists, so organizations running WP Travel Pro should act now:

Disable the plugin. Deactivate WP Travel Pro on every WordPress installation, and optionally remove it, until a patched version ships. This is the most effective mitigation.

Block the vulnerable endpoint. If you cannot disable the plugin right away, configure WAF or server-level rules to block all HTTP DELETE requests matching the path pattern /wp-json/wp-travel/v1/travel-guide/*. If you use Wordfence, make sure your firewall rules are current. For other WAF solutions, write a custom rule for this specific path.

Monitor for exploitation attempts. Check WordPress audit logs and web server access logs for DELETE requests to the travel-guide endpoint. Treat any such request from an external source as a potential exploitation attempt.

Restrict REST API access. As an additional layer of defense, add server-level or plugin-based restrictions that require authentication for all WP Travel REST API endpoints.

Evaluate alternatives. If travel booking functionality is business critical, consider moving to another plugin while WP Travel Pro remains unpatched.

The Wordfence advisory recommends reviewing the vulnerability details and applying mitigations according to your organization's risk tolerance, up to and including uninstalling the affected software.

References

• Wordfence Advisory: WP Travel Pro <= 10.6.0 Missing Authorization to Unauthenticated Arbitrary User Deletion
• WP Travel Pro Product Page
• National Vulnerability Database (NVD)
• CWE-862: Missing Authorization
• CWE Top 25 Most Dangerous Software Weaknesses
• CVE-2026-24568: WP Travel Authorization Bypass (SentinelOne)
• Broken Access Control in WP Travel 7.5.0 (Patchstack)
• WP Travel Free Plugin on WordPress.org
• Proofpoint: 2026 Vulnerability Exploitation in the Wild
• CWE-284: Improper Access Control