The WP Travel Pro plugin contains a flaw in its REST API that allows any user, even without authentication, to delete user accounts by specifying a user identifier. The endpoint /wp-json/wp-travel/v1/travel-guide/{user_id} calls a permission check that always returns true and forwards the supplied ID to WordPress’s wp_delete_user() routine without verifying the requester’s role. This enables complete removal of any account, including administrators, compromising the availability and integrity of the site’s user base.

The vulnerability affects the WP Travel Pro WordPress plugin from the vendor WPTravel. All releases up to and including version 10.6.0 are impacted. Users running any of these releases on WordPress installations are susceptible unless they have already applied a patch or upgraded beyond 10.6.0.

With a CVSS score of 9.1 the flaw is considered critical. The exploit requires no authentication and can be triggered from any network location, giving an attacker immediate and unrestricted control over account deletion. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of a check for proper authorization makes it highly likely that the flaw will be actively exploited.