WordPress Plugin Vulnerabilities

WpTravelly < 1.8.6 - Missing Authorization

Description

The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to perform actions like updating plugin settings.

Affects Plugins

Plugin icon
tour-booking-manager
Fixed in 1.8.6

References

CVE
CVE-2025-22737
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/a1b3430b-c502-47f9-bbca-69da1545d221

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
thiennv
Verified
No
WPVDB ID
1a7eb430-79af-40d4-a8c1-59b7a098e8b5

Timeline

Publicly Published
2025-01-14 (about 1 year ago)
Added
2025-01-21 (about 1 year ago)
Last Updated
2025-01-21 (about 1 year ago)

Other

Published
Title
Published
2023-12-27
Title
Quiz And Survey Master < 8.1.17 - Unauthenticated Unauthorised Action
Published
2025-12-06
Title
Gravitec.net – Web Push Notifications < 2.9.18 - Missing Authorization
Published
2026-08-15
Title
Solace Extra < 1.6.1 - Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action
Published
2024-04-11
Title
Advanced Post Block < 1.13.5 - Unauthenticated Arbitrary Post Access
Published
2026-01-07
Title
WPAdverts – Classifieds Plugin < 2.3.1 - Missing Authorization