Skip to content
Threat Feed

Tag

User-Deletion

1 brief RSS
critical advisory

WP Travel Pro Plugin Vulnerable to Arbitrary User Deletion (CVE-2026-4290)

The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the REST API endpoint, allowing unauthenticated attackers to delete arbitrary user accounts due to a flawed permission check and lack of role validation.

WP Travel Pro plugin <= 10.6.0 wordpress plugin user-deletion rce CVE-2026-4290
2r 1t 1c