Executive brief
WP Travel Engine is a WordPress plugin for managing travel bookings and trip checkout. The plugin fails to validate user access when handling booking cart operations, allowing unauthenticated attackers to view other customers' booking details (including billing information like names, addresses, and email addresses) and modify existing bookings by injecting their own data. This exposes sensitive customer data and enables attackers to tamper with booking records without authentication.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the wte_add_trip_to_cart AJAX action. The vulnerable component fails to perform ownership or authorization checks when a caller-supplied booking_id is processed, allowing unauthenticated users to access and modify arbitrary booking records via sequential ID enumeration. The attack requires obtaining a public nonce from any trip page, then sending a specially crafted JSON payload to wp-admin/admin-ajax.php with the target booking ID. Attackers can disclose booking details (trip info, cost, traveler count, dates) and stored billing information, and can overwrite victim booking records in-place. The vulnerability is specific to the AJAX action; the equivalent REST endpoint properly enforces access controls (returns HTTP 401). Fixed in version 6.8.5.
Affected products
- WP Travel Engine WP Travel Engine before 6.8.5
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 6.8.5