What is the CVSS score of CVE-2026-49078?

CVE-2026-49078 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of WP Travel Engine are affected by CVE-2026-49078?

WP Travel Engine plugin versions 6.7.10 and earlier contain an input validation flaw enabling unauthenticated attackers to modify integrity-sensitive data such as booking records, customer…

How to fix or mitigate CVE-2026-49078?

Within 24 hours: Audit all WordPress installations for WP Travel Engine deployment and document affected versions. Within 7 days: Either disable the plugin if not mission-critical, or implement Web Application Firewall (WAF) rules to reject malformed input, restrict plugin endpoints to authenticated administrators only via reverse proxy or .htaccess rules, and enable detailed audit logging on booking and customer data modifications. Within 30 days: Monitor WordPress plugin repository and Patchstack advisory for vendor patch release; upon availability, test in staging environment and deploy to patched version immediately.

WP Travel Engine CVE-2026-49078

EUVD-2026-36877 HIGH

Improper Validation of Specified Quantity in Input (CWE-1284)

2026-06-15 Patchstack

GHSA-7cq3-5g9g-7w8q

Information Disclosure Wp Travel Engine

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Plugin endpoint reachable over the web with no auth or interaction (AV:N/AC:L/PR:N/UI:N); CWE-1284 input-validation flaw enables data tampering only, so I:H with C:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:37 vuln.today

DescriptionCVE.org

Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.

AnalysisAI

Improper input validation in the WP Travel Engine WordPress plugin (versions 6.7.10 and earlier) allows remote unauthenticated attackers to tamper with integrity-sensitive data over the network with low complexity. The Patchstack-reported issue carries a CVSS 7.5 driven entirely by high integrity impact (I:H) with no confidentiality or availability effect, and no public exploit identified at time of analysis. Despite the 'Information Disclosure' tag inherited from the plugin context, the CVSS vector points to an integrity-affecting weakness rather than data leakage.

Technical ContextAI

WP Travel Engine is a widely deployed WordPress plugin used by travel and tour-operator sites to manage trip listings, bookings, and itinerary content. The underlying weakness is classified as CWE-1284 (Improper Validation of Specified Quantity in Input), a class of bug where an application accepts input without properly checking that a count, length, index, or range falls within expected bounds - leading to logic that operates on attacker-controlled quantities. In a WordPress plugin context this typically surfaces through AJAX actions, REST routes, or form handlers that fail to constrain numeric parameters, allowing unintended record modification, state changes, or business-logic abuse. The CPE 'cpe:2.3:a:wp_travel_engine:wp_travel_engine:*' confirms the affected component is the plugin itself rather than WordPress core or a bundled library.

RemediationAI

Upstream fix available per Patchstack; released patched version not independently confirmed in the supplied data - administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-travel-engine/vulnerability/wordpress-wp-travel-engine-plugin-6-7-10-other-vulnerability-type-vulnerability and upgrade WP Travel Engine to the latest version above 6.7.10 via the WordPress plugin dashboard. As a compensating control until patching, restrict access to plugin AJAX and REST endpoints (paths under /wp-admin/admin-ajax.php with wp-travel-engine actions and /wp-json/wp-travel-engine/*) using a WAF rule or web server allowlist, which will block exploitation but may also break legitimate booking flows and front-end widgets that rely on those routes. If immediate patching is not possible and the booking functionality is non-critical, temporarily deactivate the plugin from wp-admin → Plugins; this fully removes exposure but disables all trip listing and booking features on the site.