Unrestricted authentication bypass in WP Travel allows an attacker to log in without credentials, potentially gaining full control over the WordPress site. The flaw falls under the authentication weakness category (CWE‑288) and can be used to perform any privileged operation the affected account is allowed to perform, including content creation, plugin configuration, and user management.

The vulnerability affects the WordPress WP Travel plugin, versions 12.0.3 and earlier. Any site running these plugin versions is potentially exposed. Updated or higher versions are not affected.

The CVSS score of 7.3 indicates a high likelihood of serious impact. EPSS is not available, so the exact exploit probability is unknown, but the flaw is not listed in CISA KEV, suggesting no confirmed widespread exploitation. Attackers can exploit the flaw by sending crafted requests to the plugin’s authentication endpoints exposed over the public web interface. No privilege escalation beyond what the authenticated user would normally possess is required, so the risk is highest for sites with weak or default account protections.