What is the CVSS score of CVE-2026-13145?

CVE-2026-13145 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-13145?

Yes, a public proof-of-concept exploit is available for CVE-2026-13145. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-13145?

Yes, a patch is available for CVE-2026-13145. Update the affected software to the latest version immediately.

WP Travel CVE-2026-13145

EUVD-2026-51008 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-30 WPScan

GHSA-29jr-2w77-7q4c

WordPress Authentication Bypass Wp Travel Unknown

4.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via authenticated HTTP; PR:L because any registered user suffices; C:L for partial PII exposure; no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:42 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

4.3 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 4.3

DescriptionCVE.org

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.

AnalysisAI

Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.

Technical ContextAI

WP Travel is a WordPress travel-booking plugin (CPE: cpe:2.3:a:unknown:wp_travel:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's customer dashboard endpoint accepts a caller-supplied booking identifier but never validates that the referenced booking record belongs to the currently authenticated user. This is a textbook IDOR - the object key (booking ID) is presumably sequential or guessable, and the access-control check that should enforce ownership is entirely absent. The WordPress plugin architecture means any registered user on the site, regardless of role, can reach the vulnerable endpoint through standard authenticated HTTP requests.

RemediationAI

The primary fix is to update the WP Travel plugin to version 11.8.1 or later, which introduces server-side ownership verification on booking identifiers before returning booking data. The patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/f70172b6-0a55-4b99-8b3c-8170224938bb/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-13145. If immediate upgrade is not possible, a compensating control is to restrict the customer dashboard endpoint to only authenticated users whose session matches the booking owner - this requires custom code or a WordPress security plugin capable of enforcing object-level authorization. Alternatively, temporarily disabling the customer account dashboard feature eliminates the attack surface at the cost of self-service booking access for customers. Site operators should also audit access logs for anomalous booking ID enumeration patterns (sequential or non-sequential IDs accessed by a single user across multiple sessions) to determine whether opportunistic exploitation has already occurred.