What is the CVSS score of CVE-2026-16737?

CVE-2026-16737 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 15.0%.

Is there a public PoC exploit available for CVE-2026-16737?

Yes, a public proof-of-concept exploit is available for CVE-2026-16737. Prioritise patching immediately. EPSS: 15.0%.

Is there a patch available for CVE-2026-16737?

Yes, a patch is available for CVE-2026-16737. Update the affected software to the latest version immediately.

WP Travel Engine CVE-2026-16737

EUVD-2026-57090 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-12 WPScan

GHSA-4rf8-mj4r-9mgw

WordPress Authentication Bypass Wp Travel Engine Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-exposed, no privileges or interaction needed; integrity impact added (I:L) because description explicitly confirms booking record overwrite capability, contradicting the official I:N rating.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 20:57 vuln.today

CVSS changed

Aug 12, 2026 - 20:22 NVD

5.3 (MEDIUM)

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

AnalysisAI

Unauthenticated IDOR in WP Travel Engine WordPress plugin before 6.8.5 exposes all customer booking records and stored billing information to any unauthenticated attacker who supplies a valid booking identifier to an unprotected cart action. The root cause is a complete absence of authorization and ownership checks - the plugin accepts a caller-supplied booking ID and processes it without verifying the requestor's identity or entitlement. Beyond disclosure, attackers can overwrite any customer's booking record with their own data, enabling fraud, booking manipulation, or data corruption at travel agencies. A publicly available proof-of-concept exists, and at 15% EPSS this vulnerability is elevated for its CVSS 5.3 rating - warranting prompt attention.

Technical ContextAI

WP Travel Engine is a WordPress plugin (CPE: cpe:2.3:a:unknown:wp_travel_engine:*:*:*:*:*:*:*:*) that manages travel packages, bookings, and customer billing workflows. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR). The affected endpoint is an unauthenticated cart action that accepts a booking identifier directly from the caller. Because no session validation, ownership check, or capability verification is performed before loading the booking record, any arbitrary identifier supplied by an external party is honored. WordPress plugins frequently expose AJAX endpoints (wp-admin/admin-ajax.php) accessible without authentication using 'nopriv' action hooks - this pattern is the likely attack surface. The combination of no authentication requirement and no server-side ownership check makes this a textbook IDOR.

RemediationAI

Update WP Travel Engine to version 6.8.5 or later immediately - this is the vendor-released patch per advisory https://wpscan.com/vulnerability/1bc550f3-8b8f-42ac-aec9-7dcb7b0f7978/. If immediate patching is not possible, a targeted compensating control is to restrict access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) at the WAF or web server layer for actions associated with the cart flow - however, this may break legitimate unauthenticated booking functionality and requires testing. Alternatively, disable the WP Travel Engine plugin entirely until patching is feasible, accepting the trade-off of taking the booking system offline. Site operators should also audit booking records and billing data for signs of unauthorized access or tampering, particularly if the site has been exposed without the patch. Given the public POC, assume exploitation attempts are occurring and treat this as an active incident response priority.