Description

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T06:19:10.733Z",
  "pubdate": "2026-08-12T06:19:10.733Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the WP Travel Engine WordPress plugin affecting versions prior to 6.8.5.\nThe vulnerability arises due to the lack of proper authorization and ownership validation checks when processing caller-supplied booking identifiers within an unauthenticated cart action.\nUnauthenticated remote threat actors can leverage this flaw to exploit the application without possessing prior administrative privileges or valid user sessions.\nThe impact of successful exploitation is critical, enabling unauthorized information disclosure of sensitive customer data—including booking order details and stored billing information—as well as data tampering through the ability to overwrite existing booking records with malicious or arbitrary payloads.\nThis introduces severe risks to data confidentiality and integrity within the affected WordPress environment, making remediation through updating the plugin to version 6.8.5 or higher essential.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of robust access control mechanisms, specifically the absence of authorization and resource ownership verification routines within the cart action handling logic of the WP Travel Engine plugin.\nWhen processing unauthenticated cart actions, the vulnerable component accepts a caller-supplied booking identifier directly from the client request without validating whether the requesting entity is authorized to access or modify the specified resource.\nAttack flow begins with an unauthenticated attacker crafting an HTTP request directed at the vulnerable unauthenticated cart action endpoint.\nBy systematically or targetedly manipulating the caller-supplied booking identifier parameter within the request payload, the attacker bypasses any logical boundaries intended to restrict access to specific user sessions or records.\nUpon receiving the request, the application processes the database query or state mutation using the supplied identifier without verifying session context or record ownership.\nFor information disclosure, this lack of validation causes the application to retrieve and return the target customer's booking order details and stored billing information directly in the response.\nFor data overwriting, the attacker supplies custom data alongside the targeted booking identifier, causing the application to update or replace the legitimate customer's booking record with the attacker's supplied payload.\nThe vulnerability affects WP Travel Engine versions prior to 6.8.5 and is accessible remotely over the network via HTTP/HTTPS without requiring any authentication or specific privilege levels from the attacker."
}