CVE-2025-63028
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Traveler theme contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.2.6.
Risk Assessment
An attacker may gain unauthorized access to theme functions, potentially leading to site integrity compromise or data leakage.
Recommendation
Update the Traveler theme to the latest version that includes the security fix.
Other vulnerabilities in Traveler
See all- CVE-2026-93947Critical
The Traveler plugin (up to version 3.2.9) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
- CVE-2025-67917Medium
Missing Authorization vulnerability in shinetheme Traveler allows exploiting incorrectly configured access control security levels. This issue affects Traveler from n/a through <= 3.2.6.
Original NVD description (English source)
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS