# WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Authenticated (Editor+) Missing Authorization to Plugin Settings Import and Export

- **ID:** WPSEC-2026-1890
- **Plugin:** WP Travel – Ultimate Travel Booking System, Tour Management Engine (`wp-travel`), https://wordpress.org/plugins/wp-travel/
- **Affected versions:** all versions before 12.1.0
- **Fixed in:** 12.1.0 (Update to 12.1.0 or later.)
- **Severity:** Medium 5.5 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-travel
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1890/

## Description

The WP Travel plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 12.0.4 due to the settings import/export REST endpoints' permission callback only checking for the edit_others_posts capability. This makes it possible for authenticated attackers, with Editor-level access and above, to export the plugin's settings and to import arbitrary plugin-wide settings, such as payment configuration, which is normally restricted to administrators.

## References

- https://wpsec.com/vuln/WPSEC-2026-1890/
- https://plugins.svn.wordpress.org/wp-travel/tags/12.1.0/
- https://wordpress.org/plugins/wp-travel/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1890/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.