This vulnerability in the wptravelengine Travel Booking plugin arises from missing authorization checks, which results in incorrectly configured access control security levels. It affects versions up to 1.3.9. The CVSS score is 5.3 (medium), reflecting that the vulnerability can be exploited remotely without privileges or user interaction, impacting data integrity but not confidentiality or availability. No patch or vendor advisory is currently available, and no exploits are known in the wild.

The vulnerability allows unauthorized users to perform actions that should require authorization, potentially leading to unauthorized modification of data (integrity impact). There is no impact on confidentiality or availability. Since no known exploits are reported, the risk is theoretical but should be addressed to prevent misuse.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and monitor for unusual activity related to access control. Avoid exposing the vulnerable plugin to untrusted users.