Authorization Bypass in WP Travel Engine Plugin

The WP Travel Engine plugin (up to version 6.8.4) for WordPress contains an authorization bypass vulnerability identified as CVE-2026-17087. This flaw arises because the plugin fails to verify user authorization before serving sensitive booking data. Attackers can exploit this by binding an arbitrary booking ID to their session, which triggers the application to render private customer PII - including names, email addresses, street addresses, and phone numbers - directly into the checkout form's default field values. The endpoint responsible for this data retrieval is inadequately protected by a frontend nonce, which is exposed to all visitors via the global 'wteL10n' variable on trip pages. This exposure renders the nonce ineffective as an access control mechanism, allowing unauthorized entities to perform data exfiltration at scale by iterating through booking identifiers.

Impact

Successful exploitation results in the unauthorized disclosure of customer PII for users of the WP Travel Engine plugin. This impacts the privacy of customers booking travel services and potentially violates data protection regulations. The scope includes all WordPress sites running versions 6.8.4 or earlier.

Recommendation

• Update the WP Travel Engine plugin to version 6.8.5 or the latest available release to patch CVE-2026-17087.
• Review web server logs for high volumes of suspicious requests to WordPress checkout or booking endpoints originating from single IP addresses.
• Audit WordPress plugin configurations to ensure unnecessary booking endpoints are restricted or disabled if not actively in use.