The WP Travel Engine plugin for WordPress suffers from a missing capability check in the wpte_onboard_save_function_callback() function, which results in unauthorized modification of plugin settings by authenticated users with contributor-level privileges or above. This vulnerability, tracked as CVE-2024-10606 and classified under CWE-862 (Missing Authorization), affects all versions up to 6.2.1. The CVSS 3.1 base score is 4.3, indicating medium severity, with the attack vector being network-based and requiring low attack complexity and privileges. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor.

An attacker with contributor-level access or higher can modify several settings within the WP Travel Engine plugin without proper authorization. This unauthorized modification could impact business operations such as causing lost revenue or unintended page updates. There is no indication of confidentiality or availability impact, and no known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious changes in plugin settings. Avoid granting contributor or higher privileges to untrusted users.