We’re actively acquiring WordPress agencies. Sell your WordPress business to Freshy.
Let’s discuss

WP Travel Engine – Tour Booking Plugin – Tour Operator Software Vulnerability (CVE-2026-17087)

Nick Paliughi
On this page

Security Alert Summary

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress has an authorization bypass vulnerability (CVE-2026-17087) in all versions up to and including 6.8.4. An attacker can bind an arbitrary booking ID to their session and view private booking billing details that are rendered as default values in checkout form fields. The affected endpoint relies only on a frontend nonce emitted via the wteL10n global, which provides CSRF protection but does not restrict unauthenticated access.

CVE Details

  • CVE ID: CVE-2026-17087
  • Affected component: WP Travel Engine – Tour Booking Plugin – Tour Operator Software (WordPress plugin)
  • Affected versions: All versions up to and including 6.8.4
  • Published: August 16, 2026 at 7:16:30 AM
  • Last modified: August 16, 2026 at 7:16:30 AM
  • CVSS v3.1: Base Score 7.5 – HIGH; Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
  • Authentication / privileges / user interaction: No authentication required; Privileges Required: NONE; User Interaction: NONE
  • Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
  • CWE / weakness: CWE-862 (Authorization Bypass)

Technical Details

This vulnerability exists because the plugin fails to verify that a requesting user is authorized to access booking data. The endpoint in question uses a frontend nonce emitted to all visitors via the wteL10n global on trip pages. That nonce provides protection against cross-site request forgery (CSRF) but does not enforce authentication or authorization, so unauthenticated requests can succeed where an authorization check is required.

The issue allows an attacker to bind an arbitrary booking ID to their session so that the plugin renders private booking billing details (first name, last name, email, street address, city, phone number) as default values in checkout form fields. Review of the plugin code references class and controller names such as AjaxController, BillingFormFields, AddToCart, and Cart, which are involved in generating or returning the affected form values and handling booking/cart actions.

Impact is limited to disclosure of private booking billing fields rendered in checkout contexts; the vulnerability description and CVSS metrics do not indicate modification of data or denial of service.

How This Could Impact Your Website

On a typical site using this plugin, multiple users interact with the WordPress admin and frontend: a site owner, internal staff who manage bookings, and external contributors or contractors who may edit content. An unauthenticated attacker exploiting this issue could cause private billing details from other customers to appear as default values in the attacker’s checkout form. This can lead to exposure of customer names, emails, and addresses.

Practical consequences include exposure of internal or customer email addresses and contact details, which increases the risk of targeted phishing or social engineering against staff or customers. While this vulnerability does not indicate full site compromise, it does raise privacy and trust concerns for affected bookings and customers.

professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.

Recommended Actions

  • Update the affected plugin as soon as a patched version is available.
  • Review and reduce unnecessary user roles and capabilities, especially for contributor-level accounts.
  • Enforce strong passwords and enable two-factor authentication for editors and administrators.
  • Remove unused or unmaintained plugins from your site.
  • Monitor site activity and logs for unusual behavior related to booking or cart endpoints.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

Nick Paliughihttps://freshysites.com/team/nick-paliughi/
Nick was born in California and now resides in Lake Worth, FL. He has 10 years of experience building and maintaining sites in WordPress, which he is excited to put to use at Freshy. Prior to starting at Freshy in 2022 his focus was on WordPress security & malware removal. When he’s not tending to your website, Nick is installing exhibitions at art galleries and museums in Palm Beach County, and if he’s lucky surfing at the Lake Worth pier.

See our featured website design work

Check out some of the beautiful websites we’ve built for over 2,000 clients.

View projects

We offer WordPress support & maintenance

Shake the stress of ongoing maintenance with plans supported by our team of WordPress experts.

Learn more
Previous Post
Gallery by BestWebSoft Plugin Vulnerability (CVE-2026-2497)
Next Post
ShopSmart Loyalty for WooCommerce Plugin Vulnerability (CVE-2026-14832)