An authorization bypass vulnerability in the WP Travel Engine tour booking plugin allows unauthenticated attackers to view private customer billing details—including names, email addresses, street addresses, and phone numbers—by binding arbitrary booking IDs to their session, according to security researchers at Wordfence. CVE-2026-17087, disclosed August 16, 2026, affects all versions of the WordPress plugin up to and including 6.8.4 and carries a CVSS severity score of 7.5 out of 10.
TL;DR: CVE-2026-17087 allows unauthenticated attackers to extract private booking billing data from WP Travel Engine sites by exploiting missing authorization checks, exposing customer names, addresses, emails, and phone numbers.
The vulnerability stems from the plugin's failure to verify that users are authorized to access billing information before rendering it as default values in checkout form fields, Wordfence researchers explained in the CVE listing. The only access control mechanism on the affected endpoint is a frontend nonce token that the plugin publicly emits to all site visitors through the wteL10n global variable on trip listing pages. This nonce provides cross-site request forgery (CSRF) protection but does not restrict unauthenticated access to the data-retrieval function.
How the Exploit Works
Attackers can exploit the flaw without authentication or user interaction, the vulnerability report states. By manipulating booking ID parameters and binding them to their own session, threat actors can retrieve billing information that was entered by legitimate customers during previous bookings. The plugin's AddToCart Ajax controller and BillingFormFields builder class both retrieve and display this stored billing data without validating that the requesting user owns the booking or has administrative privileges.
The CVSS v3.1 vector string—CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N—confirms that the vulnerability requires no privileges, involves low attack complexity, and results in high confidentiality impact. The Exploit Prediction Scoring System (EPSS) assigns a 0.42% probability that the vulnerability will be exploited within the next 30 days, placing it higher than 35% of all tracked CVEs.
Patched Version and Remediation
Wordfence researchers linked to changesets in the WordPress plugin repository showing code modifications between version 6.8.3 and a subsequent update. The plugin's Trac repository indicates authorization checks were added to the AjaxController abstract class and the AddToCart controller class at changeset 3632552. Agencies running WP Travel Engine on client sites should update to version 6.8.5 or later, which closed the authorization gap, according to the repository commit logs.
Sites that have not yet updated remain vulnerable to information disclosure attacks that require no technical sophistication to execute. The publicly available nonce token and the lack of session validation mean attackers need only identify sites running vulnerable WP Travel Engine versions and iterate through booking IDs to harvest customer data. For agencies managing client sites with booking functionality, this represents a direct privacy compliance risk and potential liability exposure.
WordPress ecosystem security tracking shows the platform reported more than 250 weekly plugin vulnerabilities throughout 2026, with 43% exploitable without authentication, making proactive patching workflows critical for agencies maintaining multiple client installations. The WP Travel Engine vulnerability follows a pattern of authorization bypass flaws in e-commerce and booking plugins, where developers implement CSRF protections but overlook session-based access controls.
Agencies that hire web developers or WooCommerce developers for white-label projects should verify that booking and checkout functionality includes proper authorization checks at the server level, not just CSRF token validation. Testing should confirm that unauthenticated requests to data-retrieval endpoints return authorization errors rather than customer information.
The Takeaway
CVE-2026-17087 underscores the gap between CSRF protection and authorization enforcement that continues to appear in WordPress e-commerce and booking plugins. For agencies operating client sites with travel booking, event registration, or any checkout process that stores customer billing data, the vulnerability is a prompt to audit plugin authorization logic beyond what frontend nonces provide. The fact that WP Travel Engine's nonce was publicly visible yet failed to prevent data access highlights that token presence alone does not constitute adequate access control.
Agencies should prioritize updating WP Travel Engine to version 6.8.5 or later on all managed sites and consider adding automated vulnerability scanning to white-label development workflows to catch high-severity disclosures within 24 hours of publication. Sites that collected bookings while running vulnerable versions between the plugin's initial release and the August 2026 patch should treat all stored billing records as potentially compromised and consider notifying affected customers depending on jurisdictional privacy regulations. The CVSS 7.5 rating and straightforward exploit path make this a high-priority patch for any agency managing client sites with the plugin installed.