CVE-2026-13145: WP Travel Information Disclosure Flaw

CVE-2026-13145 Overview

CVE-2026-13145 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the WP Travel WordPress plugin in versions prior to 11.8.1. The plugin fails to verify ownership of booking records requested through the customer account dashboard. Any authenticated user can supply an arbitrary booking identifier and retrieve another customer's booking details, including billing address information. The flaw stems from missing authorization checks on booking lookups tied to the account dashboard endpoint.

Critical Impact
Authenticated attackers can enumerate booking identifiers to read arbitrary customer booking records, exposing personally identifiable information (PII) and billing addresses across all site customers.

Affected Products

WP Travel WordPress plugin versions before 11.8.1
WordPress sites offering customer booking dashboards via WP Travel
Travel and tour operator websites relying on WP Travel for reservations

Discovery Timeline

2026-07-30 - CVE-2026-13145 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13145

Vulnerability Analysis

The WP Travel plugin exposes a customer account dashboard where logged-in users can view their own bookings. The dashboard accepts a booking identifier as input and returns the associated booking record. The plugin does not confirm that the referenced booking belongs to the currently authenticated user. This omission allows horizontal privilege escalation between customer accounts on the same site.

An attacker with any valid customer account can iterate through sequential or guessed booking identifiers. Each request returns the target booking, including billing address information and other customer-provided data. The disclosure is limited to booking metadata surfaced by the dashboard, but that data set includes PII useful for phishing, fraud, and account takeover campaigns against affected customers.

Root Cause

The root cause is a missing authorization check between the authenticated session and the requested resource. The plugin treats the booking identifier as a trusted parameter rather than validating that the booking's owner matches the current user. This pattern maps to [CWE-639] Authorization Bypass Through User-Controlled Key and the broader Insecure Direct Object Reference class.

Attack Vector

Exploitation requires only a low-privilege authenticated customer account, which many WP Travel deployments allow through self-registration. The attacker submits requests to the account dashboard while substituting the booking identifier parameter with values belonging to other customers. No special tooling is required beyond a browser or an HTTP client. Refer to the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-13145

Indicators of Compromise

Repeated authenticated requests to WP Travel customer dashboard endpoints containing incrementing or non-sequential booking identifier parameters from a single session
Web server access logs showing one user account retrieving booking pages associated with many distinct booking IDs in a short window
Unusual outbound traffic or scraping patterns targeting /wp-admin/admin-ajax.php or WP Travel dashboard routes

Detection Strategies

Correlate WordPress user session identifiers with the booking IDs returned to detect ownership mismatches
Baseline normal booking-view activity per account and alert on volumetric anomalies
Inspect PHP error and access logs for high-cardinality booking ID enumeration from authenticated sessions

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized analytics platform for query and correlation
Enable audit logging plugins that record which user accessed which booking record
Alert on account behavior that requests bookings not created by the requesting user account

How to Mitigate CVE-2026-13145

Immediate Actions Required

Update the WP Travel plugin to version 11.8.1 or later on all affected WordPress sites
Audit recent access logs for evidence of booking ID enumeration by authenticated users
Notify customers whose booking data may have been exposed in line with applicable privacy regulations

Patch Information

The vendor addressed the issue in WP Travel version 11.8.1 by adding ownership validation to the customer dashboard booking lookup. Site administrators should apply the update through the WordPress plugin manager or by deploying the vendor-supplied package. Refer to the WPScan Vulnerability Report for advisory tracking.

Workarounds

Disable public self-registration on the WordPress site until the plugin can be updated
Restrict access to the WP Travel customer dashboard behind additional authentication controls such as a web application firewall (WAF) rule
Remove or hide the customer dashboard page temporarily if the site cannot be patched immediately

bash

# Update WP Travel plugin using WP-CLI
wp plugin update wp-travel --version=11.8.1
wp plugin list --name=wp-travel --fields=name,status,version