CVE-2024-32798: 
WordPress vulnerability analysis and mitigation

A Missing Authorization vulnerability was discovered in the WP Travel Engine WordPress plugin, affecting versions up to 5.8.0. The vulnerability was identified and reported on February 22, 2024, and was publicly disclosed on April 22, 2024. This security issue allows for price manipulation in the plugin's functionality (Patchstack).

The vulnerability is classified as a Missing Authorization (CWE-862) issue, which represents a broken access control problem. It received a CVSS v3.1 base score of 7.5 (High) from Patchstack with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, while NIST assigned a CVSS score of 5.3 (Medium) with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (NVD).

The vulnerability allows unauthenticated users to perform price manipulation actions within the WP Travel Engine plugin. This could potentially lead to unauthorized modifications of pricing information in the travel booking system (Patchstack).

The vulnerability is exploitable by unauthenticated users and requires no special privileges or user interaction. The attack vector is network-accessible, with low attack complexity (Patchstack).

The vulnerability has been fixed in WP Travel Engine version 5.8.1. Users are advised to update to this version or later to remediate the security issue (Patchstack).