Threats tagged 'ghsa-4rf8-mj4r-9mgw'

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Medium	5.3	EPSS 0.3%	CVE-2026-16737WP Travel Engine · Insecure Direct Object Reference Medium5.3EPSS 0.3%2026-08-12CVE Database V5CVE-2026-16737 The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data. EPSS 0.3%Vulnerability CWE-639 #ghsa-4rf8-mj4r-9mgw	CVE Database V5	2026-08-12

Page 1 of 1