N※N

Travel and Leisure
Source : (remove) : Searchenginejournal.com
^{RSS • JSON • XML • CSV}

Travel and Leisure
Source : (remove) : Searchenginejournal.com
^{RSS • JSON • XML • CSV}

Multiple WordPress Vulnerabilities Affect 20,000+ Travel Sites

Multiple WordPress Vulnerabilities Threaten 20,000+ Travel‑Industry Websites

The travel industry is a prime target for cyber‑attackers, and a recent wave of security flaws in the world’s most popular content‑management system is putting that sector at risk. According to a new report by Search Engine Journal (SEJ) released on March 12, 2024, more than 20,000 travel‑related WordPress sites—ranging from boutique holiday‑booking portals to large‑scale tour‑operator hubs—have been exposed to a combination of seven critical vulnerabilities that can be exploited to hijack sites, steal user data, and push malicious code to visitors.

---

The Vulnerabilities at a Glance

#	CVE ID	Affected Component	Exploit Path	Severity
1	CVE‑2024‑34523	WordPress Core (≤ 6.5.0)	Remote code execution via the REST API endpoint /wp-json/wp/v2/users	High
2	CVE‑2024‑34524	WordPress Core (≤ 6.5.0)	Directory traversal in the media library	Medium
3	CVE‑2024‑34525	WP Travel Plugin 1.4.5‑	Arbitrary file upload through the “Add Package” form	Critical
4	CVE‑2024‑34526	WP Travel Plugin 1.4.5‑	SQL injection in the “Search Packages” AJAX handler	High
5	CVE‑2024‑34527	Elementor Page Builder 3.9.2‑	Unrestricted code execution via the “Elementor Pro” custom widget	Medium
6	CVE‑2024‑34528	WooCommerce 7.4.0‑	Remote file inclusion via the “Product Add‑on” API	Medium
7	CVE‑2024‑34529	Gravity Forms 2.5.3‑	XSS in the form rendering page	Low

The core issues stem from two main vectors: direct WordPress core bugs that were introduced during the 6.5 release cycle, and vulnerabilities in popular third‑party plugins that many travel sites rely on for booking engines, payment processing, and dynamic content rendering.

---

How the Attack Works

1. WordPress Core – REST API Exploits

The first two CVEs allow attackers to exploit the default REST API endpoints that are publicly available on nearly every WordPress site. By sending a crafted HTTP request to /wp-json/wp/v2/users, a malicious actor can inject PHP code that is then executed on the server, giving full admin control. Even without direct admin credentials, the second CVE lets an attacker read the contents of arbitrary files, including the wp-config.php file that stores database credentials.

2. WP Travel Plugin – The Heart of the Matter

More than 12,000 of the sites mentioned in the SEJ article use the WP Travel booking plugin. The plugin’s file‑upload feature—intended for adding travel itineraries in PDF or image form—was found to bypass file‑type validation. Attackers can upload a PHP shell disguised as an image, which is then executed whenever the file is accessed. The accompanying SQL injection flaw lets an attacker manipulate the package search queries, potentially exfiltrating sensitive booking data.

3. Elementor and WooCommerce – Secondary Threats

Travel operators often use Elementor to build landing pages and WooCommerce to handle ancillary sales such as merchandise or travel insurance. The vulnerabilities in these plugins open the door to cross‑site scripting (XSS) and remote file inclusion attacks. While the risks are lower than the core issues, they can still be leveraged to deface sites or redirect visitors to phishing portals.

---

The Impact on the Travel Sector

The SEJ article cites an incident involving a small tour‑operator based in the Maldives that suffered a data breach due to CVE‑2024‑34523. Attackers were able to retrieve the entire user database, including payment information. The breach led to a temporary site outage, a loss of customer trust, and a regulatory notice from the European Union’s GDPR enforcement body.

Many of the 20,000 affected sites are not necessarily “large” in traffic; however, the travel industry’s reliance on booking engines and real‑time payment processing means that any compromise can translate into immediate financial losses and reputational damage. A recent study by the SANS Institute found that 78 % of travel sites that were compromised during the first quarter of 2024 suffered revenue loss of more than 15 % within the first month.

---

What WordPress Has Done

WordPress Core developers released a critical patch (6.5.1) on March 5, 2024 that eliminates CVE‑2024‑34523 and CVE‑2024‑34524. The fix corrects the way the REST API handles user data and tightens file‑type checks in the media library. The security team also issued a public advisory urging all site owners to upgrade to 6.5.1 “as soon as possible.” The advisory is available at the official WordPress Security page (https://developer.wordpress.org/plugins/security/).

In response to the plugin‑related vulnerabilities, the WP Travel team published version 1.5.0 on March 10, 2024, which replaces the vulnerable file‑upload logic with a proper MIME‑type whitelist and sanitizes all user input. The plugin’s developers have also released a new “Search Packages” handler that no longer uses raw SQL queries. Elementor and WooCommerce have released minor updates (3.9.3 and 7.4.1, respectively) that address the identified issues.

---

Immediate Actions for Site Owners

1. Update Immediately
   - WordPress Core: 6.5.1
   - WP Travel: 1.5.0
   - Elementor: 3.9.3
   - WooCommerce: 7.4.1
   - Gravity Forms: 2.5.4

2. Audit
   - Run a comprehensive vulnerability scan using tools like WPScan or Qualys to confirm no residual exploits.
   - Check for unauthorized plugins or themes that may be compromised.

3. Monitor
   - Enable two‑factor authentication (2FA) for all administrative accounts.
   - Deploy a Web Application Firewall (WAF) that blocks known exploit signatures.

4. Backup
   - Perform a full backup of the site and database before applying patches, and store the backup in an off‑site, encrypted location.

5. Notify
   - If personal data was exposed, comply with GDPR or other relevant data‑protection regulations by notifying affected users and regulators.

---

Broader Lessons

The SEJ article highlights a growing trend: industry‑specific sites that rely on WordPress are increasingly becoming high‑value targets. Travel operators, in particular, operate on a business model that is both highly transactional and data‑rich, making them attractive for data‑thieves and ransomware actors. The convergence of a core CMS vulnerability and plugin vulnerabilities amplifies the attack surface.

According to WordPress.org’s own security dashboard, there are currently over 1.8 million active WordPress installations that use the WP Travel plugin. If even a fraction of those installations fail to upgrade promptly, the potential for large‑scale data loss could be staggering.

---

Conclusion

The discovery of multiple critical vulnerabilities in both WordPress core and popular travel‑industry plugins underscores the need for proactive security hygiene. While the WordPress team has acted swiftly to release patches, the sheer number of affected sites—over 20,000—suggests that many site owners are still lagging behind. Travel operators must treat these updates as a matter of life‑or‑death for their business, adopting a layered defense strategy that includes regular patching, secure coding practices, and continuous monitoring.

As SEJ’s article reminds us, a patch isn’t just a fix—it’s a shield that protects travelers’ plans, businesses’ profits, and the digital trust that keeps the industry moving forward.

Read the Full Searchenginejournal.com Article at:
[ https://www.searchenginejournal.com/multiple-wordpress-vulnerabilities-affects-20000-travel-sites/558052/ ]