What is the CVSS score of CVE-2026-49770?

CVE-2026-49770 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of WP Travel Engine are affected by CVE-2026-49770?

WP Travel Engine WordPress plugin versions 6.7.12 and earlier contain a critical remote code execution vulnerability that requires no authentication to exploit, putting every WordPress-based travel…

How to fix or mitigate CVE-2026-49770?

Within 24 hours: Audit all WordPress installations to identify WP Travel Engine plugin presence and version; document affected environments. Within 7 days: Disable WP Travel Engine plugin on all installations; implement Web Application Firewall (WAF) rules blocking object injection attack vectors to the plugin; deploy WordPress hardening plugins with PHP deserialization protection. Within 30 days: Monitor WP Travel Engine security advisories for patch release; evaluate and plan migration to alternative travel booking plugins; validate compensating control effectiveness through security testing.

WP Travel Engine CVE-2026-49770

EUVD-2026-36893 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-15 Patchstack

GHSA-hmxm-j74j-wr83

PHP Deserialization Wp Travel Engine

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description explicitly states unauthenticated PHP Object Injection (PR:N, UI:N, AV:N); deserialization-to-RCE yields full C/I/A impact within the WordPress process scope.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:29 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the WP Travel Engine WordPress plugin versions 6.7.12 and earlier enables remote attackers to deserialize attacker-controlled data without authentication, leading to full compromise (CVSS 9.8). The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation against any WordPress site running a vulnerable installation. No public exploit identified at time of analysis, but the unauthenticated nature and WordPress plugin ecosystem make this a high-priority patching target for travel-booking sites.

Technical ContextAI

WP Travel Engine is a popular WordPress plugin used by travel agencies and tour operators to manage trip bookings, itineraries, and customer reservations. The root cause is CWE-502 (Deserialization of Untrusted Data): PHP's unserialize() function reconstructs objects from serialized strings and triggers magic methods such as __wakeup(), __destruct(), and __toString() during reconstruction. When attacker-controlled input reaches unserialize(), an adversary can craft a serialized payload that chains existing classes (a POP - Property-Oriented Programming - gadget chain) loaded by WordPress core, the plugin, or other active plugins to achieve arbitrary file write, SQL injection, or remote code execution. The CPE cpe:2.3:a:wp_travel_engine:wp_travel_engine:*:* with no upper bound qualifier reflects that all versions up to and including 6.7.12 are affected.

RemediationAI

Patch available per vendor advisory - upgrade the WP Travel Engine plugin to a version newer than 6.7.12 as published on the WordPress.org plugin repository; consult https://patchstack.com/database/wordpress/plugin/wp-travel-engine/vulnerability/wordpress-wp-travel-engine-plugin-6-7-12-php-object-injection-vulnerability for the fixed-release number, which was not explicitly provided in the input data. If immediate patching is not possible, compensating controls include deactivating the WP Travel Engine plugin (breaks all booking and trip-management functionality on the site), placing a WAF rule in front of the site that blocks request bodies containing serialized PHP markers such as 'O:' and 'a:' to plugin endpoints (may produce false positives on legitimate serialized cookies or session data), or restricting access to the plugin's frontend AJAX and REST endpoints via webserver-level allow-listing (breaks public bookings). Patchstack mApp/vPatch subscribers may also receive a virtual patch ahead of vendor remediation.