Horizon Alert
Summary of the vulnerability and why it matters
This advisory concerns a critical vulnerability in the WP Travel Pro plugin for WordPress that allows unauthenticated attackers to delete any user account, including administrative ones. The vulnerability resides in how the plugin handles user deletion requests through its API.
- Unauthorized users can delete any account.
- Admin accounts are at risk of deletion.
- Verify plugin usage and impact on your sites.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can leverage a publicly exposed REST API endpoint in the WP Travel Pro plugin to delete any user account on a WordPress site. This is possible because the plugin fails to properly validate user permissions before deleting a user, allowing an attacker to directly trigger the user deletion function. The consequence of this vulnerability is the potential loss of any user account on the system.
- No login required.
- Direct API call to delete user.
- Arbitrary user account deletion.
Live Threat
Current exploitation, exposure, and threat context
An unauthenticated attacker could delete any user account on a WordPress site running the WP Travel Pro plugin by exploiting a flaw in its REST API. This could lead to the removal of user accounts, including administrative ones, potentially disrupting site operations.
- User accounts could be deleted.
- Via a public REST API endpoint.
- Site disruption and loss of access.
Operational Fix
Recommended remediation, mitigation, and detection steps
This vulnerability impacts WordPress sites utilizing the WP Travel Pro plugin. Application owners, in coordination with infrastructure and security teams, should prioritize identifying all instances of this plugin. The initial step involves confirming exposure, business criticality, and then assigning an accountable owner to plan remediation based on the assessed risk.
- WordPress application owners.
- Verify plugin reachability and criticality.
- Plan remediation based on risk.
