CVE-2026-16737 Overview
CVE-2026-16737 affects the WP Travel Engine WordPress plugin in versions prior to 6.8.5. The plugin fails to perform authorization or ownership checks when processing a caller-supplied booking identifier in one of its unauthenticated cart actions. Unauthenticated attackers can disclose any customer's booking order details and stored billing information by submitting arbitrary booking IDs. The same weakness allows attackers to overwrite a target customer's booking record with attacker-controlled data. The flaw is classified as an Insecure Direct Object Reference [CWE-639].
Critical Impact
Unauthenticated remote attackers can enumerate and disclose customer booking records, including stored billing details, and tamper with those records without any user interaction.
Affected Products
- WP Travel Engine WordPress plugin versions prior to 6.8.5
- WordPress sites running the vulnerable plugin with public cart endpoints exposed
- Deployments using the plugin's unauthenticated cart action to load booking identifiers
Discovery Timeline
- 2026-08-12 - CVE-2026-16737 published to the National Vulnerability Database
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-16737
Vulnerability Analysis
The vulnerability is an Insecure Direct Object Reference in an unauthenticated cart action handler exposed by WP Travel Engine. The handler accepts a booking identifier supplied directly by the caller and loads the associated booking record without verifying that the requester owns or is authorized to view that record. Because the endpoint is reachable without authentication, any remote party who can reach the WordPress site can iterate booking identifiers and retrieve or modify records belonging to other customers.
The impact scope covers order details and stored billing information tied to each booking. Beyond disclosure, the same code path permits the attacker to submit their own cart data against a target booking identifier, overwriting the legitimate customer's record. This produces integrity loss for booking data even though the CVSS vector rates confidentiality as the primary technical impact.
Root Cause
The root cause is missing authorization enforcement on a request parameter that references an internal object. The handler trusts the booking identifier value from the request and dispatches lookup and update operations without a capability check, nonce validation tied to the record owner, or a session-to-record ownership comparison. This matches the pattern described in CWE-639: Authorization Bypass Through User-Controlled Key.
Attack Vector
Exploitation requires only network access to the WordPress site. An attacker crafts HTTP requests to the vulnerable unauthenticated cart action and supplies sequential or brute-forced booking identifiers. For disclosure, the response returns the target booking's order and billing information. For tampering, the attacker submits attacker-controlled billing or cart values against a chosen booking identifier and the server writes those values to the target record. No credentials, tokens, or user interaction are needed. Technical specifics are documented in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-16737
Indicators of Compromise
- Repeated unauthenticated POST or GET requests to WP Travel Engine cart action endpoints with varying booking identifier parameters
- Sequential or brute-forced numeric booking IDs in access logs from a single source IP or small IP set
- Unexpected changes to customer billing fields in booking records without a corresponding authenticated admin or customer session
- Support tickets from customers reporting altered booking or billing information
Detection Strategies
- Review WordPress access logs for high-volume access to WP Travel Engine cart AJAX or REST endpoints from unauthenticated sources
- Correlate booking record modification events with the absence of a matching authenticated session for the record owner
- Alert on enumeration patterns where a single client accesses many distinct booking identifiers in a short window
Monitoring Recommendations
- Enable verbose logging on the WP Travel Engine cart handler and forward logs to a centralized analytics platform
- Monitor the WordPress database for out-of-band updates to booking and billing tables and baseline normal change rates
- Deploy a web application firewall rule to flag requests to the vulnerable cart action that include booking identifier parameters from unauthenticated clients
How to Mitigate CVE-2026-16737
Immediate Actions Required
- Upgrade the WP Travel Engine plugin to version 6.8.5 or later on every affected WordPress site
- Audit booking and billing records for unauthorized modifications made prior to patching
- Notify affected customers if disclosure or tampering of their booking records is confirmed
- Rotate any secrets or tokens that may have been exposed through booking metadata
Patch Information
The vendor addressed the missing authorization checks in WP Travel Engine version 6.8.5. Administrators should update through the WordPress plugin manager or by deploying the packaged release. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the WP Travel Engine plugin until the patched version can be deployed if booking functionality is not business-critical
- Restrict access to the vulnerable cart action endpoints at the web application firewall or reverse proxy for unauthenticated clients
- Place the WordPress site behind an authentication gateway during the remediation window if the site is intended for internal use only
# Configuration example: WP-CLI update of the affected plugin
wp plugin update wp-travel-engine --version=6.8.5
wp plugin list --name=wp-travel-engine --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
