CVE-2026-16737

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.5

Description The plugin fails to perform authorization or ownership checks when loading a booking identifier provided by the user in an unauthenticated cart action. This allows unauthenticated attackers to disclose booking order details and stored billing information of any customer. Additionally, attackers can overwrite a customer's booking record with their own data via the wte add trip to cart action.

Recommendations Update WP Travel Engine to version 6.8.5 or later.