A missing authorization flaw, identified as CWE‑862, exists in the magepeopleteam WpTravelly tour‑booking‑manager plugin. The vulnerability arises from incorrectly configured access control security levels, allowing an attacker to reach administrative functions or sensitive booking data that should be restricted to privileged users. This can lead to unauthorized modification of travel plans, alteration of booking records, or exposure of customer information, compromising the integrity and confidentiality of the site’s data.

The issue affects sites running the WpTravelly WordPress plugin version 2.1.7 or earlier. Users who have installed the plugin on their WordPress sites and have not yet updated are at risk. The vulnerability is specific to the plugin’s internal API endpoints and does not affect the core WordPress installation.

With a CVSS score of 4.3 the vulnerability carries moderate severity, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that attackers may exploit the flaw via exposed admin URLs or by using a compromised user session, leveraging the lack of proper authorization checks. While the risk is modest, the potential impact on booking data warrants swift remediation.