EUVD-2026-51008
GHSA-29jr-2w77-7q4c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable via authenticated HTTP; PR:L because any registered user suffices; C:L for partial PII exposure; no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
AnalysisAI
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
WP Travel is a WordPress travel-booking plugin (CPE: cpe:2.3:a:unknown:wp_travel:*:*:*:*:*:*:*:*). The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's customer dashboard endpoint accepts a caller-supplied booking identifier but never validates that the referenced booking record belongs to the currently authenticated user. This is a textbook IDOR - the object key (booking ID) is presumably sequential or guessable, and the access-control check that should enforce ownership is entirely absent. The WordPress plugin architecture means any registered user on the site, regardless of role, can reach the vulnerable endpoint through standard authenticated HTTP requests.
RemediationAI
The primary fix is to update the WP Travel plugin to version 11.8.1 or later, which introduces server-side ownership verification on booking identifiers before returning booking data. The patch is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/f70172b6-0a55-4b99-8b3c-8170224938bb/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-13145. If immediate upgrade is not possible, a compensating control is to restrict the customer dashboard endpoint to only authenticated users whose session matches the booking owner - this requires custom code or a WordPress security plugin capable of enforcing object-level authorization. Alternatively, temporarily disabling the customer account dashboard feature eliminates the attack surface at the cost of self-service booking access for customers. Site operators should also audit access logs for anomalous booking ID enumeration patterns (sequential or non-sequential IDs accessed by a single user across multiple sessions) to determine whether opportunistic exploitation has already occurred.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a pay
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1
Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remot
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6.
WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the ban
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticat
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to ext
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to un
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today