WP Travel CVE-2026-13145

Exploitation requires a valid authenticated session on the target WordPress site - any registered user role (subscriber, customer, contributor, etc.) is sufficient; no elevated privileges are needed. The vulnerable endpoint is the customer account dashboard, which must be enabled and accessible (it is part of the plugin's core functionality and enabled by default). The attacker must be able to guess or enumerate booking identifiers; if these are sequential integers, enumeration is trivial. Exploitation is limited to sites where WP Travel is installed and active, and where user registration is open or the attacker has otherwise obtained credentials. Unauthenticated users cannot exploit this vulnerability.

CVSS 3.1 scores this at 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, accurately reflecting that network exploitation is trivial once authenticated, but impact is limited to confidentiality of booking PII with no integrity or availability consequence. EPSS sits at just 0.14% (4th percentile), consistent with a low-automation, targeted class of vulnerability. SSVC confirms exploitation status as 'poc' (proof-of-concept only, not active), non-automatable (each booking ID must be iterated individually), and partial technical impact. The combination of low EPSS, no KEV listing, and non-automatable SSVC rating suggests this is realistically a low-volume, opportunistic attack rather than a mass-exploitation scenario. The primary real-world concern is GDPR and privacy regulation exposure for travel-site operators who store customer billing addresses - the business risk may exceed the raw technical CVSS score for operators in regulated jurisdictions.

An attacker registers or already possesses a low-privilege account on a WordPress travel site running WP Travel before 11.8.1. After authenticating, they navigate to the customer dashboard and intercept the HTTP request that loads their own booking, then systematically replace the booking ID parameter with sequential integers to enumerate other customers' records. A publicly available proof-of-concept confirms this technique, meaning the attacker requires no specialized tooling beyond a web proxy such as Burp Suite.