CVE-2025-5282: 
WordPress vulnerability analysis and mitigation

CVE-2025-5282 is a missing authorization vulnerability in the WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress. It affects all versions up to and including 6.5.1, allowing unauthenticated attackers to delete arbitrary posts due to a missing capability check on the delete_package() function. The vulnerability was published on June 13, 2025, and assigned a CVSS v3.1 base score of 7.5 (High) (Wordfence, Red Hat).

The root cause is classified as CWE-862 (Missing Authorization): the delete_package() function in the plugin's REST API v2 Trip controller does not perform any capability or authentication check before executing a post deletion operation. An unauthenticated remote attacker can send a crafted HTTP request to the vulnerable REST API endpoint to trigger the function and delete arbitrary WordPress posts. No user interaction or privileges are required, and attack complexity is low. The patch was applied in version 6.5.2, modifying includes/classes/Core/Controllers/RestAPI/V2/Trip.php to enforce proper authorization checks (WordPress Trac, Wordfence).

Successful exploitation allows any unauthenticated attacker to permanently delete arbitrary posts on the affected WordPress site, resulting in significant data loss and disruption of website content. The integrity of the WordPress site is directly compromised, as tour packages, pages, or other post types can be wiped without any authentication. There is no confidentiality or availability impact beyond content destruction, but the loss of business-critical travel and booking content could have severe operational consequences for tour operators relying on the plugin (Wordfence).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.038%, indicating a low probability of exploitation in the near term. However, the unauthenticated, network-accessible nature of the flaw makes it trivially exploitable if targeted.

1. Reconnaissance: Identify WordPress sites running the WP Travel Engine plugin (versions ≤ 6.5.1) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt files for version information.
2. Identify the vulnerable endpoint: Locate the REST API endpoint associated with the delete_package() function in the plugin's REST API v2 Trip controller (e.g., a DELETE or POST request to the plugin's REST route for package deletion).
3. Craft the malicious request: Send an unauthenticated HTTP request (no cookies, tokens, or credentials required) to the vulnerable REST API endpoint, specifying the ID of the target post to be deleted.
4. Achieve arbitrary post deletion: The server processes the request without authorization checks, deleting the specified post. The attacker can repeat this process to delete multiple posts, including tour packages, pages, or other content (Wordfence, WordPress Trac).

• Network: Unusual unauthenticated HTTP DELETE or POST requests to the WP Travel Engine REST API endpoints (e.g., /wp-json/wp-travel-engine/v2/trips/...) from unexpected or external IP addresses.
• Logs: WordPress access logs showing REST API requests to package/trip deletion endpoints without associated authentication headers or nonces; repeated requests targeting different post IDs in a short timeframe.
• Application: Unexpected disappearance of tour package posts, trip listings, or other WordPress post types; WordPress activity logs (if enabled via plugins like WP Activity Log) showing post deletions attributed to unauthenticated or anonymous users.

The vendor released version 6.5.2 of the WP Travel Engine plugin, which adds proper authorization checks to the delete_package() function. All site administrators should immediately update to version 6.5.2 or later via the WordPress plugin dashboard. As a temporary workaround if immediate patching is not possible, consider disabling the plugin or restricting access to the WordPress REST API for unauthenticated users. Regularly backing up website content is also recommended to enable recovery in the event of exploitation (WordPress Trac, Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for June 9–15, 2025, and published threat intelligence details (Wordfence Blog). The vulnerability was noted on security-focused social media accounts such as RedPacketSecurity on Mastodon. No significant broader media coverage or notable researcher commentary beyond standard disclosure channels has been observed.