The WP Travel Engine – Tour Booking Plugin for WordPress suffers from a missing capability check in the delete_package() function, allowing attackers without any authentication to delete arbitrary posts. This flaw is a classical Missing Authorization issue (CWE‑862) and can result in the loss of tour listings, pricing information, and other critical booking data. The vulnerability directly compromises data integrity and availability for the affected site.

All installations of the WP Travel Engine plugin up to and including version 6.5.1 are impacted. Users running WordPress with this plugin version should verify their current release; any instance prior to 6.5.2 lacks the necessary authorization guard.

With a CVSS score of 7.5, the issue carries high severity. The EPSS score is below 1%, indicating relatively low current exploit probability, and the vulnerability is not currently flagged in the CISA KEV catalog. Nevertheless, the attack path is straightforward: an unauthenticated user can target the REST API endpoint responsible for deletion and trigger post removal with no additional credentials.