CVE-2026-16737 — WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

CVE-2026-16737

WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart PUBLISHED

Description (CNA)

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Travel Engine	affected 0 before 6.8.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1bc550f3-8b8f-42ac-aec9-7dcb7b0f7978/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.