CVE-2026-17087
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The WP Travel Engine plugin for WordPress up to version 6.8.4 is vulnerable to authorization bypass, allowing unauthenticated attackers to view private booking billing details, including the customer's first name, last name, email, street address, city, and phone number, by binding an arbitrary booking ID to the attacker's session.
Risk Assessment
Attackers can access sensitive personal data of customers, violating privacy and potentially leading to identity theft or fraud.
Recommendation
Update the WP Travel Engine plugin to the latest version if a patch is available. Additionally, restrict access to endpoints and implement additional authorization mechanisms.
Other vulnerabilities in WP Travel Engine
See all- CVE-2026-49770Critical
There is an unauthenticated PHP Object Injection vulnerability in WP Travel Engine versions up to 6.7.12.
- CVE-2026-9231High
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server.
- CVE-2026-16737Medium
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
- CVE-2026-12501Medium
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid. This allows unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.
- CVE-2026-12500High
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a plugin option. Unauthenticated users can overwrite a site-wide WP Travel Engine option (the public nonce is served to anonymous visitors).
- CVE-2026-10834Medium
The WP Travel Engine WordPress plugin before version 6.8.1 fails to properly validate the source of a user-supplied profile image path before moving the file. This allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path.
- CVE-2026-49078High
There is an unauthenticated vulnerability type in WP Travel Engine versions up to 6.7.10 that could be exploited by attackers.
- CVE-2026-2437Medium
Stored XSS vulnerability in the WP Travel Engine plugin for WordPress (versions up to 6.7.5). Insufficient input sanitization and output escaping in the 'wte_trip_tax' shortcode allow authenticated attackers (contributor level and above) to inject malicious JavaScript.
Original NVD description (English source)
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS