CVE-2026-17087: CWE-862 Missing Authorization in wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.
AI Analysis
Technical Summary
CVE-2026-17087 is an authorization bypass vulnerability (CWE-862) in the WP Travel Engine – Tour Booking Plugin for WordPress, affecting all versions up to and including 6.8.4. The plugin does not properly verify that a user is authorized to perform certain actions, allowing unauthenticated attackers to view private booking billing details by binding arbitrary booking IDs to their sessions. The only access control is a frontend nonce exposed publicly, which only provides CSRF protection and does not prevent unauthorized access. This vulnerability leads to unauthorized disclosure of sensitive customer information.
Potential Impact
An unauthenticated attacker can access sensitive personal information of customers, including first and last names, email addresses, street addresses, cities, and phone numbers, by exploiting the authorization bypass. This compromises customer privacy and could facilitate further attacks such as phishing or identity theft. The vulnerability does not impact integrity or availability but has a high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor and apply patches promptly once released.
CVE-2026-17087: CWE-862 Missing Authorization in wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Description
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.
CVSS v3.1
Score 7.5high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-17087 is an authorization bypass vulnerability (CWE-862) in the WP Travel Engine – Tour Booking Plugin for WordPress, affecting all versions up to and including 6.8.4. The plugin does not properly verify that a user is authorized to perform certain actions, allowing unauthenticated attackers to view private booking billing details by binding arbitrary booking IDs to their sessions. The only access control is a frontend nonce exposed publicly, which only provides CSRF protection and does not prevent unauthorized access. This vulnerability leads to unauthorized disclosure of sensitive customer information.
Potential Impact
An unauthenticated attacker can access sensitive personal information of customers, including first and last names, email addresses, street addresses, cities, and phone numbers, by exploiting the authorization bypass. This compromises customer privacy and could facilitate further attacks such as phishing or identity theft. The vulnerability does not impact integrity or availability but has a high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor and apply patches promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-24T14:42:16.432Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a815f2fbf8831d539a5f14b
Added to database: 08/16/2026, 06:56:47 UTC
Last enriched: 08/23/2026, 13:22:58 UTC
Last updated: 09/04/2026, 10:52:07 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.