CVE-2023-47224

CVE-2023-47224 is a missing authorization vulnerability (CWE-862) in the WP Travel WordPress plugin (wp-travel). It enables exploiting incorrectly configured access control security levels and affects all versions of the plugin from n/a through 7.8.0. The issue carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating high severity due to its network accessibility and integrity impact.

Unauthenticated attackers (PR:N) can exploit this vulnerability over the network (AV:N) with low attack complexity (AC:L) and without requiring user interaction (UI:N). Exploitation allows high integrity impact (I:H), potentially enabling unauthorized modifications to data or resources protected by the plugin's access controls.

Patchstack provides details on this broken access control vulnerability in the WP Travel plugin via its advisory at https://patchstack.com/database/Wordpress/Plugin/wp-travel/vulnerability/wordpress-wp-travel-plugin-7-5-0-broken-access-control-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance and patch information.