EUVD-2026-59926
GHSA-82j5-9jq4-r793
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVisit public trip page
-
DeliveryExtract wteL10n nonce from page JavaScript
-
ExploitCraft AJAX POST with arbitrary booking ID
-
ExecutionServer binds victim booking to attacker session
-
PersistCheckout form pre-populates with victim PII
-
ImpactAttacker reads PII from HTTP response
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target WordPress site must be running WP Travel Engine version 6.8.4 or earlier. The attacker must be able to access at least one publicly visible trip page on the site to retrieve the wteL10n nonce from the page's JavaScript globals - sites that have removed all public trip pages or placed them behind authentication would not be exploitable via this path. The attacker must supply a valid existing booking ID; while these are typically sequential integers that can be enumerated, sites with very few bookings present a smaller target surface. No account, authentication, or special network position is required beyond standard HTTP access. The checkout AJAX endpoint must be reachable (standard WordPress AJAX at /wp-admin/admin-ajax.php), which is default behavior. There is no configuration toggle that isolates the vulnerable code path. |
| Impact | The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects the attack profile: fully remote, no authentication, no user interaction, and high confidentiality impact due to PII disclosure. The low attack complexity is justified because the nonce is openly broadcast on public pages and booking IDs are typically sequential integers, making enumeration trivial. There is no KEV listing and no published POC at time of analysis, so exploitation remains unconfirmed in the wild; however, the mechanical simplicity of the attack (retrieve nonce from page source, iterate booking IDs via AJAX call) means the effective exploitation barrier is very low even without a formal POC. The impact is limited to confidentiality - no write access or service disruption - but the exposed data (full customer PII) carries significant GDPR and privacy compliance consequences for operators. No conflicting CVSS signals are present; the vector is internally consistent with the described attack path. |
| Exploit ScenarioDerived | An attacker visits any publicly accessible trip page on a vulnerable WordPress site, reads the wteL10n JavaScript object from the page source to extract the valid nonce, then submits a crafted AJAX POST to the add-to-cart endpoint with an incremented booking ID and the extracted nonce. The server binds the target booking to the attacker's session and the checkout form renders the victim customer's full PII as pre-populated field values, which the attacker reads directly from the HTTP response. No public POC has been identified, but the attack requires only basic HTTP tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 16, 2026
Unauthenticated PII exposure in WP Travel Engine (WordPress plugin, all versions ≤ 6.8.4) allows any visitor to retrieve private customer booking details - including full name, email, street address, city, and phone number - by supplying an arbitrary booking ID to the checkout endpoint. The plugin's only access control on the affected AJAX handler is a frontend nonce broadcast publicly to all visitors via the wteL10n JavaScript global, meaning it functions solely as a CSRF token and does not gate unauthenticated access. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial and requires no prior account or privileges.
RemediationAI
An upstream patch has been committed to the WordPress plugin repository (changeset 3632552: https://plugins.trac.wordpress.org/changeset?reponame=&old=3632552%40wp-travel-engine&new=3632552%40wp-travel-engine); a released patched version number is not independently confirmed from the available data - verify the current published version via https://wordpress.org/plugins/wp-travel-engine/ and update to any version beyond 6.8.4 once confirmed. Until the update is applied, operators can reduce exposure by restricting public access to trip pages (where the nonce is emitted) using HTTP authentication or IP allowlisting, though this will break the booking funnel for legitimate customers. Alternatively, a WAF rule blocking AJAX requests to the add-to-cart endpoint that carry a booking_id parameter for sessions with no prior cart state can serve as a targeted compensating control without affecting normal checkout flow. Do not rely on obscurity of booking IDs as a control, as sequential enumeration is trivial.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the WP Travel Engine WordPress plugin (CPE: cpe:2.3:a:wptravelengine:wp_travel_engine_-_tour_booking_plugin_-_tour_operator_software:*:*:*:*:*:*:*:*), specifically in the checkout form's billing field pre-population logic. Source references point to BillingFormFields.php (L87), the Legacy Cart class (L373), and the AddToCart AJAX controller (L31, L232), all under the plugin's includes/classes hierarchy. The root cause is CWE-862 (Missing Authorization): the AddToCart AJAX endpoint accepts an attacker-supplied booking ID and binds it to the requesting session, causing the checkout form to render stored billing PII as default field values. The nonce validation present (AjaxController.php L52) is a CSRF countermeasure only - because the nonce itself is emitted to all unauthenticated visitors as part of the wteL10n JavaScript global on trip pages, any visitor can extract it and supply it, bypassing any intended access restriction entirely.
Know when Wp Travel Engine Tour Booking Plugin Tour Operator Software gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible AJAX endpoint with publicly emitted nonce; no authentication gate and no special conditions; confidentiality impact high due to full PII exposure, with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The WP Travel Engine - Tour Booking Plugin - Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details - including the victim customer's first name, last name, email address, street address, city, and phone number - rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.
Executive ViewAI
WP Travel Engine WordPress plugin (versions 6.8.4 and below) allows any unauthenticated website visitor to retrieve customer booking data including names, emails, phone numbers, and addresses-creating immediate risk of customer PII breach for affected organizations. The attack requires no technical sophistication or exploit code; no vendor patch currently exists. Organizations running this plugin face regulatory liability under GDPR/CCPA and reputational damage from customer data exposure.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Disable WP Travel Engine plugin entirely; (2) If plugin cannot be disabled, implement IP-based access controls and Web Application Firewall rules to block requests to checkout endpoints; (3) Rate-limit checkout API requests to increase exploitation cost; (4) Monitor access logs for booking ID enumeration patterns; (5) Apply additional encryption to customer booking data in the database; (6) Restrict database user privileges to read-only for booking records.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authenticated users with contributor-level access or higher on a WordPress site running the WP Travel Engine plugin 6.8.
Stored Cross-Site Scripting in WP Travel Engine plugin versions up to 6.7.5 allows authenticated contributors and above
Exploit-DB