CVE-2026-9231

There is an unauthenticated PHP Object Injection vulnerability in WP Travel Engine versions up to 6.7.12.

The WP Travel Engine plugin for WordPress up to version 6.8.4 is vulnerable to authorization bypass, allowing unauthenticated attackers to view private booking billing details, including the customer's first name, last name, email, street address, city, and phone number, by binding an arbitrary booking ID to the attacker's session.

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid. This allows unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a plugin option. Unauthenticated users can overwrite a site-wide WP Travel Engine option (the public nonce is served to anonymous visitors).

The WP Travel Engine WordPress plugin before version 6.8.1 fails to properly validate the source of a user-supplied profile image path before moving the file. This allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path.

There is an unauthenticated vulnerability type in WP Travel Engine versions up to 6.7.10 that could be exploited by attackers.

Stored XSS vulnerability in the WP Travel Engine plugin for WordPress (versions up to 6.7.5). Insufficient input sanitization and output escaping in the 'wte_trip_tax' shortcode allow authenticated attackers (contributor level and above) to inject malicious JavaScript.