How severe is CVE-2024-0434?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Magepeopleteam Travelly – Tour & Travel Booking Manager For Woocommerce | Hotel Solution

CVE-2024-0434

The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to create and publish new place posts. This function is also vulnerable to CSRF.

EPSS: 0.004 (31.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Magepeopleteam Travelly – Tour & Travel Booking Manager For Woocommerce | Hotel Solution — versions 0

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

Frequently asked questions

What is CVE-2024-0434?: CVE-2024-0434 is a medium-severity vulnerability in Magepeopleteam Travelly – Tour & Travel Booking Manager For Woocommerce | Hotel Solution, classified under Improper Access Control. CVSS score: 5.3/10. Published 2024-05-29.
How severe is CVE-2024-0434?: Medium severity. CVSS v3 base score is 5.3 out of 10.