WordPress - WP Travel Pro - CRITICAL - CVE-2026-4290. The WP Travel Pro plugin for WordPress is vulnerable, allowing arbitrary user deletion through the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint. This vulnerability stems from the check_permission() callback always returning true, and the Database::delete() method directly using the user ID in the wp_delete_user() function without verifying user roles. This flaw allows unauthenticated attackers to delete any user account, including those with administrator privileges, posing a significant risk to sites using the plugin.