CVE-2025-22737: WpTravelly Auth Bypass Vulnerability

CVE-2025-22737 Overview

CVE-2025-22737 is a missing authorization vulnerability in the magepeopleteam WpTravelly (tour-booking-manager) WordPress plugin. The flaw affects all versions up to and including 1.8.5. It stems from functionality that is not properly constrained by Access Control Lists (ACLs), allowing unauthenticated network-based attackers to reach features that should require authorization. The issue is classified under CWE-862: Missing Authorization. Successful exploitation permits limited unauthorized modification of plugin data without user interaction.

Critical Impact
Unauthenticated attackers can invoke plugin functionality that lacks proper capability checks, resulting in limited integrity impact on WordPress sites running WpTravelly <= 1.8.5.

Affected Products

magepeopleteam WpTravelly (tour-booking-manager) plugin for WordPress
All versions from initial release through 1.8.5
WordPress sites using the tour-booking-manager plugin for tour and booking management

Discovery Timeline

2025-01-15 - CVE-2025-22737 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22737

Vulnerability Analysis

The vulnerability is a broken access control issue in the WpTravelly plugin. One or more plugin endpoints execute privileged actions without verifying that the caller holds the required WordPress capability. An unauthenticated remote attacker can send crafted HTTP requests to these endpoints and trigger functionality intended for authorized users only.

The impact is limited to integrity, as reflected in the CVSS vector components C:N/I:L/A:N. Attackers cannot directly read sensitive data or crash the site through this flaw, but they can modify plugin state or invoke administrative-adjacent actions. The attack requires no privileges (PR:N) and no user interaction (UI:N), making automated mass exploitation practical against exposed WordPress installations.

Root Cause

The root cause is the absence of capability and nonce validation on plugin action handlers. WordPress plugins must call current_user_can() and verify nonces via check_admin_referer() or wp_verify_nonce() before performing state-changing operations. The affected WpTravelly handlers omit these checks, leaving functionality reachable by any HTTP client.

Attack Vector

Exploitation occurs over the network against the WordPress AJAX or admin-post endpoints exposed by the plugin. An attacker identifies vulnerable action parameters registered by tour-booking-manager and issues HTTP POST or GET requests without authentication cookies. The plugin processes the request and executes the underlying operation. See the Patchstack WPTravelly Plugin Vulnerability advisory for further technical details.

Detection Methods for CVE-2025-22737

Indicators of Compromise

Unauthenticated HTTP requests to /wp-admin/admin-ajax.php or /wp-admin/admin-post.php containing WpTravelly action parameters
Unexpected modifications to tour, booking, or plugin configuration records in the WordPress database
Anomalous request volume targeting plugin endpoints from a single source IP or range

Detection Strategies

Review WordPress and web server access logs for requests referencing tour-booking-manager actions without a valid authentication session
Enable audit logging on WordPress option and postmeta tables to identify unexpected writes originating from anonymous sessions
Correlate plugin-related HTTP 200 responses with the absence of wordpress_logged_in_* cookies in the same request

Monitoring Recommendations

Deploy a Web Application Firewall (WAF) with rules targeting broken access control patterns against WordPress AJAX endpoints
Monitor plugin version inventory across managed WordPress sites and alert on installations at version <= 1.8.5
Track EPSS movement for CVE-2025-22737, currently at 0.334% (percentile 25.4), for shifts indicating active exploitation interest

How to Mitigate CVE-2025-22737

Immediate Actions Required

Upgrade the WpTravelly (tour-booking-manager) plugin to a version later than 1.8.5 as soon as a patched release is available from magepeopleteam
Audit WordPress user accounts, booking data, and plugin settings for unauthorized modifications since January 2025
Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php at the WAF or reverse proxy layer where feasible

Patch Information

Refer to the Patchstack advisory for WPTravelly for the latest patch status. Administrators should apply the vendor-supplied update through the WordPress plugin manager once released and confirm the installed version reports higher than 1.8.5.

Workarounds

Disable the WpTravelly plugin until a fixed version is installed if tour-booking functionality is not business-critical
Deploy virtual patching rules via a WAF such as Patchstack, Wordfence, or an equivalent platform to block anonymous requests to plugin action handlers
Enforce HTTP authentication or IP allowlisting on wp-admin paths to reduce the exposure of vulnerable endpoints

bash

# Example: restrict admin-ajax.php to authenticated sessions via nginx
location = /wp-admin/admin-ajax.php {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass php_upstream;
}