Vulnerabilities / WP Travel – Ultimate Travel Booking System, Tour Management Engine / WPSEC-2026-1892
WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Authenticated (Contributor+) Missing Authorization to Itinerary Enquiry Disclosure and Modification
Medium 5.4
CWE-862Fixed in 12.1.0
- ID
- WPSEC-2026-1892
- Plugin
- WP Travel – Ultimate Travel Booking System, Tour Management Engine (wp-travel)
- Affected
- from 10.5.0 before 12.1.0
- Remediation
- Update to 12.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- WP Travel – Ultimate Travel Booking System, Tour Management Engine on WPSec AttackSurface
- Fix released
- Published
Description
The WP Travel plugin for WordPress is vulnerable to unauthorized access of data and modification of data in all versions up to, and including, 12.0.4 due to insufficient capability checks on the get_itinerary_enquiries and wptravel_mark_enquiry_read AJAX actions, which only required the edit_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve all itinerary enquiries, including customer names, email addresses and messages, and to mark enquiries as read.
References
- https://wpsec.com/vuln/WPSEC-2026-1892/
- https://plugins.svn.wordpress.org/wp-travel/tags/12.1.0/
- https://wordpress.org/plugins/wp-travel/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS