EUVD-2026-57090
GHSA-4rf8-mj4r-9mgw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-exposed, no privileges or interaction needed; integrity impact added (I:L) because description explicitly confirms booking record overwrite capability, contradicting the official I:N rating.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
AnalysisAI
Unauthenticated IDOR in WP Travel Engine WordPress plugin before 6.8.5 exposes all customer booking records and stored billing information to any unauthenticated attacker who supplies a valid booking identifier to an unprotected cart action. The root cause is a complete absence of authorization and ownership checks - the plugin accepts a caller-supplied booking ID and processes it without verifying the requestor's identity or entitlement. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond the plugin being installed and active on a WordPress site. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) scores this at 5.3, reflecting only partial confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint, supplying an enumerated or guessed booking identifier in the cart action parameter. Because the plugin performs no session or ownership check, it returns the full booking record including the victim customer's name, contact details, and stored billing information. … |
| Remediation | Update WP Travel Engine to version 6.8.5 or later immediately - this is the vendor-released patch per advisory https://wpscan.com/vulnerability/1bc550f3-8b8f-42ac-aec9-7dcb7b0f7978/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wp Travel Engine
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.7
Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper
Unauthenticated PHP Object Injection in the WP Travel Engine WordPress plugin versions 6.7.12 and earlier enables remote
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.7
The WP Travel Engine plugin for WordPress contains a missing capability check in the delete_package() function, allowing
Improper input validation in the WP Travel Engine WordPress plugin (versions 6.7.10 and earlier) allows remote unauthent
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel E
Missing Authorization vulnerability in WP Travel Engine.8.0. Rated medium severity (CVSS 5.3), this vulnerability is rem
The WP Travel Engine - Tour Booking Plugin - Tour Operator Software plugin for WordPress is vulnerable to unauthorized m
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today