The vulnerability CVE-2024-0434 affects the Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress, specifically in versions up to and including 1.7.1. Due to improper access control (CWE-284), the 'ttbm_new_place_save' function lacks a capability check, enabling unauthenticated users to create and publish new place posts. This function is also susceptible to CSRF attacks, which could allow attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. There is no information about an available patch or vendor advisory.

An attacker without authentication can create and publish new place posts within the affected WordPress plugin, potentially leading to unauthorized content injection or manipulation. The CSRF vulnerability further increases the risk by allowing attackers to trick authenticated users into performing unintended actions. There is no direct confidentiality or availability impact reported. The integrity of the plugin's data can be partially compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin and monitor for unauthorized content creation. Consider disabling or limiting the use of the affected functionality if possible. Implement web application firewall (WAF) rules to block unauthorized requests targeting the vulnerable function. Avoid clicking on suspicious links that could trigger CSRF attacks.