Vulnerabilities / WP Travel – Ultimate Travel Booking System, Tour Management Engine
WP Travel – Ultimate Travel Booking System, Tour Management Engine vulnerabilities
Advisories WPSec published for WP Travel – Ultimate Travel Booking System, Tour Management Engine. Other sources may list more. Its attack surface: WP Travel – Ultimate Travel Booking System, Tour Management Engine on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-29 | WPSEC-2026-1892 | WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Authenticated (Contributor+) Missing Authorization to Itinerary Enquiry Disclosure and Modification | Medium 5.4 | 12.1.0 |
| 2026-10-29 | WPSEC-2026-1891 | WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Unauthenticated Coupon Usage Restriction Bypass | Medium 5.3 | 12.1.0 |
| 2026-10-29 | WPSEC-2026-1890 | WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Authenticated (Editor+) Missing Authorization to Plugin Settings Import and Export | Medium 5.5 | 12.1.0 |
License: CC BY 4.0