CVE-2026-24568: 
WordPress vulnerability analysis and mitigation

CVE-2026-24568 is a Missing Authorization (Broken Access Control) vulnerability in the WP Travel WordPress plugin that allows unauthenticated attackers to exploit incorrectly configured access control security levels. It affects WP Travel versions up to and including 11.1.0, with version 11.1.1 containing the fix. The vulnerability was reported by researcher Nabil Irawan on December 22, 2025, and published by Patchstack on January 23, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing certain privileged actions. This allows unauthenticated network-based attackers to invoke functionality that should be restricted to higher-privileged users, such as administrators. The flaw is consistent with a missing nonce token or capability check on a WordPress AJAX handler or REST API endpoint within the WP Travel plugin. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows unauthenticated attackers to perform unauthorized actions that should require elevated privileges, resulting in a low integrity impact with no confidentiality or availability impact. The scope is limited to the affected WordPress installation, and there is no evidence of data exposure or lateral movement potential. Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic (Patchstack).

No active in-the-wild exploitation has been confirmed, and no public exploit code is known to be available. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority with unlikely exploitation impact, though it notes the vulnerability class is commonly used in mass-exploit campaigns against WordPress sites (Patchstack).

The primary remediation is to update the WP Travel plugin to version 11.1.1 or later, which contains the fix for this vulnerability. Site administrators unable to update immediately should consult their hosting provider or web developer for assistance. Patchstack users can enable auto-update for vulnerable plugins to automate remediation (Patchstack).