# WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Authenticated (Contributor+) Missing Authorization to Itinerary Enquiry Disclosure and Modification

- **ID:** WPSEC-2026-1892
- **Plugin:** WP Travel – Ultimate Travel Booking System, Tour Management Engine (`wp-travel`), https://wordpress.org/plugins/wp-travel/
- **Affected versions:** from 10.5.0 before 12.1.0
- **Fixed in:** 12.1.0 (Update to 12.1.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-travel
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1892/

## Description

The WP Travel plugin for WordPress is vulnerable to unauthorized access of data and modification of data in all versions up to, and including, 12.0.4 due to insufficient capability checks on the get_itinerary_enquiries and wptravel_mark_enquiry_read AJAX actions, which only required the edit_posts capability. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve all itinerary enquiries, including customer names, email addresses and messages, and to mark enquiries as read.

## References

- https://wpsec.com/vuln/WPSEC-2026-1892/
- https://plugins.svn.wordpress.org/wp-travel/tags/12.1.0/
- https://wordpress.org/plugins/wp-travel/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1892/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.