CVE-2026-13145 is an authorization bypass vulnerability (CWE-639) in the WP Travel WordPress plugin. The plugin fails to verify ownership of booking records on the customer account dashboard, enabling any authenticated user to read booking details of other users by manipulating the booking identifier parameter. This exposes sensitive customer data including billing address information. The vulnerability affects versions prior to 11.8.1, although the exact affected versions are not explicitly stated in the provided data.

An attacker with a valid login can access private booking information of other customers, including billing addresses, violating user privacy and potentially enabling further targeted attacks or fraud. There is no indication that this vulnerability allows modification or deletion of data, but unauthorized disclosure of personal information is a significant privacy breach.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the WP Travel plugin vendor advisories for updates. Until a fix is available, restricting access to trusted users and minimizing the number of users with login privileges may reduce risk.