WP Travel plugin fails to properly sanitize user input, permitting attackers to execute blind SQL queries. The flaw enables reading, modifying, or deleting database records, which can expose personal information, alter site content, and compromise overall integrity. It does not directly allow code execution, but the impact on data confidentiality and availability is significant.

WordPress sites using WP Travel plugin versions up to and including 11.4.0 are vulnerable. The lack of a specific lower bound means any installation with the plugin in this range is at risk; administrators should confirm the installed version and compare it to the affected range.

The CVSS score of 7.7 indicates high severity, while the EPSS score is not available and it is absent from the CISA KEV catalog. Attackers can exploit the issue remotely by crafting HTTP requests to the plugin’s exposed endpoints. The attack vector is inferred from the web-based interaction and absence of additional authentication requirements; successful exploitation would allow data exfiltration or manipulation.