CVE-2024-11926 Information

Description

The Travel Booking WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ‘__stPartnerCreateServiceRental’ ‘st_delete_order_item’ ‘_st_partner_approve_booking’ ‘save_order_item’ and ‘__userDenyEachInfo’ functions in all versions up to and including 3.1.6. This makes it possible for authenticated attackers with Subscriber-level access and above to modify posts delete posts and pages approve arbitrary orders insert orders with arbitrary prices and deny user information.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Reference

https://travelerwp.com/traveler-changelog/ https://www.wordfence.com/threat-intel/vulnerabilities/id/d21c7537-8437-43aa-ab52-9e14d27a6e7f?source=cve

Attack Complexity

LOW

Privileges Required

LOW

User Interaction Required

LOW

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

NONE

Base Severity

6.5