Skip to content
Threat Feed

Product

WP Travel Pro Plugin <= 10.6.0

1 brief RSS
critical advisory

WP Travel Pro Plugin Vulnerable to Arbitrary User Deletion (CVE-2026-4290)

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the REST API endpoint, allowing unauthenticated attackers to delete arbitrary user accounts due to a flawed permission check and lack of role validation.

WP Travel Pro plugin <= 10.6.0 wordpress plugin user-deletion rce CVE-2026-4290
2r 1t 1c