CVE-2026-17087 is an authorization bypass vulnerability (CWE-862) in the WP Travel Engine – Tour Booking Plugin for WordPress, affecting all versions up to and including 6.8.4. The vulnerability arises because the plugin does not properly verify that a user is authorized to perform certain actions. Attackers can exploit this by binding arbitrary booking IDs to their sessions, enabling them to view private booking billing details such as first name, last name, email address, street address, city, and phone number. The only access control is a frontend nonce emitted publicly on trip pages, which only protects against CSRF but does not prevent unauthenticated access.

An unauthenticated attacker can access sensitive personal information of customers, including names, email addresses, and physical addresses, by exploiting the authorization bypass. This compromises customer privacy and may lead to further targeted attacks or identity theft. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin functionality and monitor for suspicious activity. Avoid exposing booking IDs publicly and consider implementing additional server-side authorization checks.