The WP Travel Pro plugin for WordPress up to version 10.6.0 contains a missing authorization vulnerability (CWE-862) in the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint. The check_permission() callback incorrectly returns true unconditionally, allowing unauthenticated requests to invoke the Database::delete() method, which calls wp_delete_user() directly with the provided user ID without validating the user's role. This flaw enables attackers to delete arbitrary user accounts, including administrators, leading to high impact on integrity and availability.

An unauthenticated attacker can delete any user account on the affected WordPress site using the vulnerable REST API endpoint. This includes administrator accounts, potentially resulting in loss of administrative access and disruption of site operations. The CVSS score of 9.1 reflects the critical severity with network attack vector, no privileges required, no user interaction, and high impact on integrity and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable REST API endpoint by disabling or limiting the WP Travel Pro plugin's REST API functionality or applying custom access controls to prevent unauthenticated user deletion requests.