Booking Manipulation in WP Travel Engine

WP Travel Engine is a popular free WordPress plugin for travel agencies and tour operators. It lets you create trip packages, manage bookings, and handle payments. If you’re running version 6.7.10 or earlier, you need to update immediately — there’s a vulnerability that allows attackers to create fraudulent bookings and access customer data without logging in.

What’s the problem?

The plugin’s booking system uses AJAX endpoints to handle cart operations, checkout, and payment processing. These endpoints are designed to be accessible from the front-end (where customers interact with your site), but the security implementation has a flaw: several critical endpoints don’t properly restrict access to authenticated users.

This means an attacker can:

• Create bookings with zero cost, bypassing payment entirely
• View customer names, email addresses, phone numbers, and booking details
• Trigger receipt emails to be sent to attacker-controlled addresses, harvesting customer data
• Manipulate trip pricing and booking quantities

The vulnerability affects versions up to and including 6.7.10. Version 6.7.11 includes the fix.

How does it work?

The plugin registers AJAX handlers like this:

class Checkout extends AjaxController {
    const ALLOW_NOPRIV = true;  // Accessible to non-logged-in users
    const NONCE_ACTION = 'wp_xhr';
}

The ALLOW_NOPRIV = true flag means the endpoint is accessible to anyone, logged in or not. The plugin does check for a nonce (a security token), but the check is non-fatal — it logs an error but continues processing.

More critically, the plugin accepts pricing data directly from the client:

$trip_price = $posted_data['trip-cost'] ?? 0;
$child_cost = $posted_data['child-travelers-cost'] ?? 0;

An attacker can submit trip-cost: 0 and create a free booking.

What’s the impact?

For a travel agency, this is serious:

1. Revenue loss — Attackers create bookings without paying
2. Data breach — Customer contact details and booking information are exposed
3. Reputation damage — Your customers’ data is in the hands of attackers
4. Operational chaos — You have to manually cancel fraudulent bookings and investigate

If you’re running this plugin on a live site, attackers may already be exploiting this.

What should you do?

Immediately:

1. Update to WP Travel Engine 6.7.11 or later
2. Review your recent bookings for suspicious activity (zero-cost bookings, unusual patterns)
3. Check your email logs for unauthorised receipt requests
4. Consider temporarily disabling the plugin if you can’t update right now

After updating:

1. Audit your booking data for the past month
2. Contact any customers affected by fraudulent bookings
3. Monitor your site for continued suspicious activity

The fix

Version 6.7.11 addresses this by:

• Restricting sensitive endpoints to authenticated users only
• Adding proper capability checks (e.g., current_user_can())
• Validating pricing data server-side instead of trusting client-submitted values
• Implementing rate limiting on sensitive endpoints

Summary

If you’re using WP Travel Engine for your travel business, update now. This isn’t a “nice to have” — it’s a critical security issue that directly impacts your revenue and customer trust. The fix is straightforward: upgrade to 6.7.11.

CVE: CVE-2026-49078
CVSS Score: 7.5 (HIGH)
Affected versions: ≤ 6.7.10
Patched in: 6.7.11