WordPress Travel Plugin Authorization Bypass Exposes Customer Data

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view private booking billing details — including the victim customer's first name, last name, email address, street address, city, and phone number — rendered as default values in checkout form fields by binding an arbitrary booking ID to the attacker's session. The only access control on the endpoint is a frontend nonce that is publicly emitted to all visitors via the wteL10n global on trip pages, meaning it provides CSRF protection only and does not restrict unauthenticated access.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Travel Engine plugin for WordPress contains a critical authorization bypass vulnerability that allows unauthenticated attackers to access sensitive customer billing information. By exploiting improper authorization checks, attackers can view private booking records containing personally identifiable information (PII) such as names, email addresses, physical addresses, and phone numbers. This vulnerability affects all versions up to 6.8.4 and poses significant risk to e-commerce platforms, travel agencies, and tour operators using the plugin—potentially impacting both business reputation and customer trust while exposing organizations to regulatory compliance violations under GDPR, CCPA, and similar data protection frameworks.

Casky's 283 matched security skills leverage Claude AI with extended reasoning to identify the attack patterns associated with this vulnerability across MITRE ATT&ACK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would detect suspicious patterns including unauthenticated requests accessing `/wp-admin/` or plugin-specific API endpoints without valid authentication tokens, abnormal data exfiltration attempts targeting booking endpoints, and unauthorized access to customer database queries. The platform's skills map these indicators to CWE-862 (Missing Authorization) detection patterns, enabling teams to identify POST/GET requests to sensitive booking endpoints that bypass role-based access controls, log unusual patterns of PII access from non-authenticated sessions, and correlate timing anomalies suggesting automated exploitation attempts before customer data reaches attackers.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-17087.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-17087

Casky has 283 skills that investigate the attack patterns behind CVE-2026-17087. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn