{
 "id": "WPSEC-2026-1892",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1892/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1892/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1892/index.md",
 "title": "WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Authenticated (Contributor+) Missing Authorization to Itinerary Enquiry Disclosure and Modification",
 "description": "The WP Travel plugin for WordPress is vulnerable to unauthorized access of data and modification of data in all versions up to, and including, 12.0.4 due to insufficient capability checks on the get_itinerary_enquiries and wptravel_mark_enquiry_read AJAX actions, which only required the edit_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve all itinerary enquiries, including customer names, email addresses and messages, and to mark enquiries as read.",
 "plugin": {
  "slug": "wp-travel",
  "name": "WP Travel – Ultimate Travel Booking System, Tour Management Engine",
  "full_name": "WP Travel – Ultimate Travel Booking System, Tour Management Engine",
  "wordpress_org": "https://wordpress.org/plugins/wp-travel/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-travel/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-travel"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "10.5.0",
    "from_inclusive": true,
    "to": "12.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 10.5.0 before 12.1.0"
  ]
 },
 "introduced_in": "10.5.0",
 "fixed_in": "12.1.0",
 "remediation": "Update to 12.1.0 or later.",
 "fix_released": "2026-10-28T04:07:54+00:00",
 "published": "2026-10-29T04:44:41+00:00",
 "updated": "2026-10-28T09:12:11.835046+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1892/",
  "https://plugins.svn.wordpress.org/wp-travel/tags/12.1.0/",
  "https://wordpress.org/plugins/wp-travel/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-travel",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-29"
 }
}