The vulnerability CVE-2025-22737 in magepeopleteam WpTravelly (versions <= 1.8.5) is due to missing authorization controls, allowing unauthorized access to certain functionality within the tour-booking-manager plugin. This issue arises from improper enforcement of ACLs, potentially enabling an attacker with network access and no privileges to perform actions that should be restricted. The CVSS 3.1 base score is 5.3 (medium), with attack vector network, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No patch or official vendor advisory is currently provided, and no exploits are known in the wild.

The vulnerability allows unauthorized users to access and potentially manipulate functionality within the WpTravelly plugin that should be restricted by access controls. The impact is limited to integrity, with no confidentiality or availability impact reported. Because no privileges or user interaction are required, the vulnerability could be exploited remotely over the network. However, the medium CVSS score reflects the limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is available at this time, users should monitor magepeopleteam communications for updates. Until a fix is released, consider restricting network access to the affected plugin functionality or disabling the plugin if feasible to reduce exposure.