CVE-2024-10606: 
WordPress vulnerability analysis and mitigation

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress contains a vulnerability (CVE-2024-10606) due to a missing capability check on the wpte_onboard_save_function_callback() function in versions up to and including 6.2.1. The vulnerability was discovered and disclosed on November 23, 2024 (NVD).

The vulnerability stems from a missing authorization check in the wpte_onboard_save_function_callback() function. This security flaw has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The issue is classified as CWE-862: Missing Authorization (WPScan).

The vulnerability allows authenticated attackers with contributor-level access or higher to modify several plugin settings. This unauthorized access could potentially result in lost revenue and unauthorized page updates (Wordfence).

The vulnerability requires an authenticated user with at least contributor-level access to exploit. The attack vector is network-based with low attack complexity and requires no user interaction (WPScan).

The vulnerability has been patched in version 6.2.2 of the WP Travel Engine plugin. Users are advised to update to this latest version to mitigate the security risk (NVD).