The raratheme Travel Agency plugin version 1.4.9 and earlier contains a CSRF vulnerability. This security flaw permits attackers to induce authenticated users to perform actions without their consent by exploiting the lack of proper request validation. The vulnerability does not impact confidentiality or availability but can lead to integrity issues through unauthorized state changes. No official patch or vendor advisory is provided in the available data.

The vulnerability allows an attacker to perform unauthorized state-changing actions on behalf of an authenticated user without their consent, potentially leading to integrity issues within the affected application. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, users should consider implementing CSRF protections such as verifying anti-CSRF tokens or restricting actions to trusted users. Monitor vendor communications for updates on patches or official mitigations.