CVE-2026-4290: WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators

Synopsis

This is a missing-authorization flaw in the WP Travel Pro WordPress plugin that allows arbitrary user deletion. The vulnerable REST API endpoint /wp-json/wp-travel/v1/travel-guide/{user_id} can be reached over the network with no authentication, because the permission callback unconditionally returns true and the delete method passes the user ID straight to wp_delete_user() with no role check. Successful exploitation lets an attacker delete any account on the site, including administrators, causing loss of integrity and availability of the user base. No fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress REST API over the network, typically any internet-exposed site running the plugin.

• AuthenticationNot required

  The permission callback returns true unconditionally, so no account or session is needed.

• Victim interactionNot required

  The deletion is triggered by a direct REST call and requires no action from any site user.

• Attack complexityDetail

  Attack complexity is low; sending a single request to the endpoint with a target user ID reliably deletes that account.

Blast Radius

• Deletes arbitrary WordPress user accounts, including administrators, removing legitimate operators from the site.
• Destroys user-owned content associations and metadata tied to deleted accounts, with reassignment dependent on the wp_delete_user call path.
• Can render the site effectively unmanageable if all admin accounts are removed, producing a denial-of-service outcome for site operations.
• Does not directly disclose stored data, but the integrity and availability damage to the user base is severe and not easily reversible.