CVE-2025-5282
📋 TL;DR
The WP Travel Engine plugin for WordPress has an unauthenticated data deletion vulnerability. Attackers can delete arbitrary posts without authentication due to missing capability checks. All WordPress sites using this plugin up to version 6.5.1 are affected.
💻 Affected Systems
- WP Travel Engine – Tour Booking Plugin – Tour Operator Software
📦 What is this software?
Wp Travel Engine by Wptravelengine
⚠️ Risk & Real-World Impact
Worst Case
Complete website content destruction with all posts deleted, causing business disruption and data loss.
Likely Case
Selective deletion of important posts, pages, or custom post types managed by the plugin.
If Mitigated
No impact if plugin is patched or removed, or if proper web application firewalls block the exploit.
🎯 Exploit Status
Simple HTTP request to vulnerable endpoint can trigger deletion.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.5.2
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3305447/wp-travel-engine/tags/6.5.2/includes/classes/Core/Controllers/RestAPI/V2/Trip.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find WP Travel Engine. 4. Click Update Now to version 6.5.2 or higher.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily deactivate the WP Travel Engine plugin until patched.
wp plugin deactivate wp-travel-engine
Web Application Firewall Rule
allBlock requests to the vulnerable REST API endpoint.
Block POST requests to /wp-json/wp-travel-engine/v2/trip/delete-package
🧯 If You Can't Patch
- Disable the WP Travel Engine plugin immediately.
- Implement strict network segmentation and monitor for deletion attempts.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel for WP Travel Engine plugin version 6.5.1 or lower.Check Version:
wp plugin get wp-travel-engine --field=versionVerify Fix Applied:
Confirm plugin version is 6.5.2 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /wp-json/wp-travel-engine/v2/trip/delete-package from unauthenticated users
- Sudden increase in post deletions in WordPress logs
Network Indicators:
- Unusual POST requests to WordPress REST API from external IPs
- Traffic patterns showing mass deletion attempts
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-json/wp-travel-engine/v2/trip/delete-package" OR message="*delete_package*")