This vulnerability in magepeopleteam's WpTravelly plugin involves missing authorization checks, which means that certain actions or resources may be accessible without proper permission validation. The affected versions include all releases up to 2.1.7. The lack of proper access control can lead to unauthorized users performing actions that should be restricted. No patch or official fix information is currently available, and no known exploitation has been reported.

The impact is unauthorized access or actions within the WpTravelly plugin due to missing authorization controls. This could allow attackers to bypass intended security restrictions, potentially leading to unauthorized data access or manipulation within the tour-booking-manager functionality. However, without further details or confirmed exploitation, the exact impact scope remains unclear.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor for updates from magepeopleteam and consider restricting access to the plugin's administrative functions as a precautionary measure.