CVE-2025-67917
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Missing Authorization vulnerability in shinetheme Traveler allows exploiting incorrectly configured access control security levels. This issue affects Traveler from n/a through <= 3.2.6.
Risk Assessment
Risk of unauthorized access to functionality that should be protected, potentially leading to data integrity issues or unauthorized actions.
Recommendation
It is recommended to update the Traveler theme to the latest available version if a patch is available, and to review access control configuration.
Other vulnerabilities in Traveler
See all- CVE-2026-93947Critical
The Traveler plugin (up to version 3.2.9) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
- CVE-2025-63028Medium
The Traveler theme contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.2.6.
Original NVD description (English source)
Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS