The vulnerability is a broken access control flaw in the WordPress Travel Booking theme where authorization checks are missing or incorrectly configured. As a result, an attacker can perform actions that should be restricted by the theme’s security levels, potentially accessing or modifying content, booking details, or administrative functions that are intended to be protected. The weakness is classified as CWE-862 (Missing Authorization).

Affected systems are WordPress sites that use the wptravelengine Travel Booking theme version 1.3.9 or earlier. The vulnerability applies to all releases from the initial release of the theme through 1.3.9 inclusive.

The CVSS score of 5.3 indicates medium severity. The EPSS score of less than 1% suggests that exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through web traffic to the theme’s endpoints, where a malicious user could craft requests to bypass intended access restrictions. The impact could be data exposure, unauthorized booking actions, or other administrative misuse.