CVE-2026-17087: 
WordPress vulnerability analysis and mitigation

CVE-2026-17087 is an authorization bypass vulnerability in the WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress, affecting all versions up to and including 6.8.4. The flaw allows unauthenticated attackers to access private booking billing details — including customer names, email addresses, street addresses, cities, and phone numbers — by binding an arbitrary booking ID to their session. It was published on August 16, 2026, with a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is CWE-862 (Missing Authorization): the plugin's AJAX endpoint does not verify that the requesting user is authenticated or authorized to access a specific booking record. The only access control in place is a frontend nonce emitted publicly via the wteL10n JavaScript global on all trip pages, which provides CSRF protection only and does not restrict unauthenticated access. An attacker can obtain this nonce simply by visiting any trip page, then supply an arbitrary booking ID to the endpoint to retrieve the associated billing form fields pre-populated with the victim's personal data. Relevant vulnerable code paths include AjaxController.php#L52, BillingFormFields.php#L87, AddToCart.php#L31 and #L232, and Cart.php#L373 (GitHub Advisory).

Successful exploitation results in unauthorized disclosure of private customer PII — specifically first name, last name, email address, street address, city, and phone number — for any booking stored in the affected WordPress site. The impact is limited to confidentiality (no integrity or availability impact), but the exposed data could facilitate phishing, identity theft, or social engineering attacks against affected customers. Any booking ID on the platform is potentially enumerable, meaning the scope of exposure could extend to all customers who have made bookings through the plugin (GitHub Advisory, Feedly).

As of the disclosure date (August 16, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires no authentication, no special privileges, and no user interaction, making it trivially exploitable by any network-accessible attacker who can visit a trip page to obtain the public nonce. No threat actor attribution, EPSS score, or CISA KEV catalog listing has been reported at this time.

1. Reconnaissance: Identify a WordPress site running WP Travel Engine plugin version ≤ 6.8.4 by browsing to a trip/tour page and inspecting the page source or JavaScript globals for the presence of wteL10n.
2. Obtain the public nonce: Extract the nonce value from the wteL10n JavaScript object emitted on any trip page — this is publicly accessible to all visitors without authentication.
3. Enumerate booking IDs: Guess or sequentially enumerate integer booking IDs (WordPress post IDs for booking records), which are typically predictable sequential integers.
4. Send crafted AJAX request: Submit an HTTP request to the plugin's AJAX endpoint (e.g., wp-admin/admin-ajax.php) with the obtained nonce and a target booking ID bound to the attacker's session, triggering the AddToCart or related handler.
5. Harvest PII: Parse the response, which will contain the victim customer's billing details (first name, last name, email, street address, city, phone number) pre-populated as default values in the checkout form fields (GitHub Advisory).

• Network: Unusual or high-volume HTTP POST requests to wp-admin/admin-ajax.php with WP Travel Engine action parameters from unauthenticated sessions; sequential or rapid enumeration of booking IDs in request parameters.
• Logs: WordPress access logs showing repeated unauthenticated AJAX requests to the booking/cart endpoint with varying booking ID values from the same IP or user agent; requests containing the wteL10n nonce from non-logged-in sessions.
• Behavioral: Automated scanning patterns (sequential booking ID increments) originating from a single IP or small IP range in a short time window.

Site administrators should update the WP Travel Engine plugin to a version newer than 6.8.4, which addresses the missing authorization check. A patch commit is referenced in the plugin's Trac repository (GitHub Advisory). As a temporary workaround, administrators can restrict access to wp-admin/admin-ajax.php for unauthenticated users at the web server or WAF level, though this may impact other plugin functionality. Implementing server-side verification of user authentication and booking ownership before returning billing data is the recommended long-term fix.

The vulnerability was flagged by Wordfence's threat intelligence team and published to the GitHub Advisory Database on August 16, 2026 (GitHub Advisory). Aggregator platforms including VulDB, CIRCL, and ENISA's EUVD have indexed the advisory. No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database propagation.