Description

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-16T07:16:30.423Z",
  "pubdate": "2026-08-16T07:16:30.423Z",
  "executiveSummary": "An authorization bypass vulnerability has been identified in the WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress in all versions up to, and including, 6.8.4.\nThe flaw stems from missing authorization checks on a sensitive endpoint, allowing unauthenticated remote attackers to access private booking billing details.\nThe exposed Personally Identifiable Information (PII) includes the victim customer's first name, last name, email address, street address, city, and phone number.\nThe risk implication is severe privacy exposure and potential data harvesting of customer records without requiring elevated privileges.\nAttacker capabilities include querying arbitrary booking identifiers and binding them to their own active session to render victim details within checkout form fields.\nExploitation requirements include network access to the target WordPress site and harvesting a publicly emitted frontend nonce from the wteL10n global object on trip pages, which provides Cross-Site Request Forgery (CSRF) protection rather than proper access control.",
  "technicalDetails": "The root cause of the vulnerability is an insufficient access control mechanism combined with improper authorization validation on the backend endpoint handling booking data retrieval.\nThe vulnerable component relies solely on a frontend nonce, specifically emitted via the wteL10n global variable on trip pages, which is publicly accessible to all site visitors.\nBecause this nonce is designed strictly for CSRF mitigation rather than access control or session authorization, it fails to verify whether the requesting party possesses legitimate administrative or ownership privileges over the requested booking record.\nThe attack flow proceeds as follows: First, an unauthenticated attacker inspects a trip page on the target WordPress installation to extract the publicly available wteL10n nonce.\nSecond, the attacker crafts a request targeting the vulnerable endpoint, supplying an arbitrary booking ID alongside the harvested nonce.\nThird, the application binds the arbitrary booking ID to the attacker's active session without validating if the current session corresponds to the rightful owner of the booking.\nFinally, the endpoint returns the private booking billing details, rendering sensitive customer data—such as first name, last name, email address, street address, city, and phone number—directly into default values within checkout form fields.\nThe affected versions include all releases up to, and including, 6.8.4 of the WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin.\nNo authentication or privilege requirements are necessary for the attacker, as the vector is fully exploitable by unauthenticated remote entities over the network.\nThe post-exploitation impact centers on unauthorized data disclosure, enabling malicious actors to systematically enumerate and harvest sensitive customer PII associated with tour bookings."
}