Veille CVE

Recherche « WP Travel Engine »

8 CVE

Critique 1 Élevée 4 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WP Travel Engine » ✕
  1. CVE-2026-9231 7.5 Élevée

    wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

  2. CVE-2026-17087 7.5 Élevée

    wptravelengine WP Travel Engine – Tour Booking Plugin – Tour Operator Software

    The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.

  3. CVE-2026-16737 5.3 Moyenne

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

  4. CVE-2026-12501 5.3 Moyenne

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.

  5. CVE-2026-12500 7.5 Élevée

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

  6. CVE-2026-10834 4.6 Moyenne

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.

  7. CVE-2026-49770 9.8 Critique

    WP Travel Engine

    Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

  8. CVE-2026-49078 7.5 Élevée

    WP Travel Engine

    Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions.