EUVD-2026-57090
GHSA-4rf8-mj4r-9mgw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-exposed, no privileges or interaction needed; integrity impact added (I:L) because description explicitly confirms booking record overwrite capability, contradicting the official I:N rating.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
AnalysisAI
Unauthenticated IDOR in WP Travel Engine WordPress plugin before 6.8.5 exposes all customer booking records and stored billing information to any unauthenticated attacker who supplies a valid booking identifier to an unprotected cart action. The root cause is a complete absence of authorization and ownership checks - the plugin accepts a caller-supplied booking ID and processes it without verifying the requestor's identity or entitlement. Beyond disclosure, attackers can overwrite any customer's booking record with their own data, enabling fraud, booking manipulation, or data corruption at travel agencies. A publicly available proof-of-concept exists, and at 15% EPSS this vulnerability is elevated for its CVSS 5.3 rating - warranting prompt attention.
Technical ContextAI
WP Travel Engine is a WordPress plugin (CPE: cpe:2.3:a:unknown:wp_travel_engine:*:*:*:*:*:*:*:*) that manages travel packages, bookings, and customer billing workflows. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR). The affected endpoint is an unauthenticated cart action that accepts a booking identifier directly from the caller. Because no session validation, ownership check, or capability verification is performed before loading the booking record, any arbitrary identifier supplied by an external party is honored. WordPress plugins frequently expose AJAX endpoints (wp-admin/admin-ajax.php) accessible without authentication using 'nopriv' action hooks - this pattern is the likely attack surface. The combination of no authentication requirement and no server-side ownership check makes this a textbook IDOR.
RemediationAI
Update WP Travel Engine to version 6.8.5 or later immediately - this is the vendor-released patch per advisory https://wpscan.com/vulnerability/1bc550f3-8b8f-42ac-aec9-7dcb7b0f7978/. If immediate patching is not possible, a targeted compensating control is to restrict access to WordPress AJAX endpoints (wp-admin/admin-ajax.php) at the WAF or web server layer for actions associated with the cart flow - however, this may break legitimate unauthenticated booking functionality and requires testing. Alternatively, disable the WP Travel Engine plugin entirely until patching is feasible, accepting the trade-off of taking the booking system offline. Site operators should also audit booking records and billing data for signs of unauthorized access or tampering, particularly if the site has been exposed without the patch. Given the public POC, assume exploitation attempts are occurring and treat this as an active incident response priority.
More in Wp Travel Engine
View allImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.7
Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper
Unauthenticated PHP Object Injection in the WP Travel Engine WordPress plugin versions 6.7.12 and earlier enables remote
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.7
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in
The WP Travel Engine plugin for WordPress contains a missing capability check in the delete_package() function, allowing
Improper input validation in the WP Travel Engine WordPress plugin (versions 6.7.10 and earlier) allows remote unauthent
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Travel E
Missing Authorization vulnerability in WP Travel Engine.8.0. Rated medium severity (CVSS 5.3), this vulnerability is rem
The WP Travel Engine - Tour Booking Plugin - Tour Operator Software plugin for WordPress is vulnerable to unauthorized m
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today