CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.

CWE: CWE-862 ／ 公開 2026年8月16日 ／ 最終更新 2026年8月20日

WP Travel Engine – Tour Booking Plugin – Tour Operator Software を 6.8.5 以降に更新してください。これで本脆弱性は解消します。

WP Travel Engine – Tour Booking Plugin – Tour Operator Software の他の脆弱性を見る →