CVE-2026-17087: 
WordPress vulnerability analysis and mitigation

CVE-2026-17087 is an authorization bypass vulnerability in the WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress, affecting all versions up to and including 6.8.4. The flaw allows unauthenticated attackers to access private booking billing details — including customer names, email addresses, street addresses, cities, and phone numbers — by binding an arbitrary booking ID to their session. It was published on August 16, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory).

The vulnerability is classified as CWE-862 (Missing Authorization). The plugin's AJAX endpoint responsible for populating checkout form fields with billing details relies solely on a frontend nonce (wteL10n global) for access control, which is publicly emitted to all site visitors on trip pages and provides only CSRF protection — not authentication or authorization enforcement. An unauthenticated attacker can supply an arbitrary booking ID to the endpoint, causing the server to return the associated customer's billing data as pre-filled form field values. Relevant code paths are visible in the plugin source at AjaxController.php, BillingFormFields.php, AddToCart.php, and Cart.php (GitHub Advisory).

Successful exploitation exposes private customer PII — including first name, last name, email address, street address, city, and phone number — to any unauthenticated network attacker. The attack is purely a confidentiality breach with no integrity or availability impact; however, the exposed data could facilitate phishing, identity theft, or social engineering campaigns targeting affected customers. Because the attack is automatable and requires no privileges or user interaction, an attacker could enumerate booking IDs at scale to harvest large volumes of customer records (GitHub Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is rated automatable by NVD SSVC analysis, meaning it can be exploited at scale without manual interaction. The EPSS score is approximately 0.415%, placing it in the 34th percentile for exploitation likelihood within 30 days. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the WP Travel Engine plugin (version ≤ 6.8.4) using search engines, Shodan, or WPScan. Confirm the plugin is active by visiting a trip/tour page and inspecting the page source for the wteL10n JavaScript global, which contains the publicly emitted nonce.
2. Extract the nonce: Parse the wteL10n object from the trip page HTML/JavaScript to obtain the valid frontend nonce value required by the AJAX endpoint.
3. Enumerate booking IDs: Send authenticated-style AJAX requests to the plugin's checkout/cart endpoint (e.g., WordPress admin-ajax.php) with sequentially or randomly guessed booking IDs, supplying the extracted nonce as the access control token.
4. Retrieve billing details: For each valid booking ID, the server returns the associated customer's billing information (name, email, address, city, phone number) pre-populated as default values in the checkout form fields.
5. Harvest PII at scale: Automate the enumeration loop to collect customer PII across all bookings on the target site (GitHub Advisory).

• Network: High volume of POST requests to wp-admin/admin-ajax.php with WP Travel Engine-specific action parameters from a single or rotating IP address; sequential or random booking ID values in request parameters.
• Logs: WordPress access logs showing repeated AJAX requests to the booking/cart endpoint without corresponding authenticated sessions; unusual patterns of requests originating from non-customer IP ranges.
• Application: Checkout form submissions or AJAX calls referencing booking IDs that do not correspond to the requesting user's session or account.

WordPress site administrators should update the WP Travel Engine plugin to a version newer than 6.8.4 as soon as a patched release becomes available. In the interim, consider disabling the plugin or restricting access to the AJAX endpoint via a web application firewall (WAF) rule that blocks unauthenticated requests to the booking billing endpoint. Additionally, implement server-side authorization checks that verify both user authentication and booking ownership before returning any billing data (GitHub Advisory, Wordfence).

Wordfence included this vulnerability in its weekly WordPress vulnerability report for August 10–16, 2026, highlighting the authorization bypass risk to tour booking site operators (Wordfence). No significant broader media coverage or notable researcher commentary beyond standard vulnerability database aggregation has been observed at this time.