Broken Access Control

AJAXBroken Access Control

Booking Manipulation in WP Travel Engine

CVE-2026-49078: WP Travel Engine ≤6.7.10 lets unauthenticated attackers create fraudulent bookings and access customer data via AJAX endpoints with non-fatal nonce validation.