CVE-2026-13145

The CVE-2026-13145 entry affects the WP Travel WordPress plugin, specifically versions prior to 11.8.1. The vulnerability, described as an IDOR, occurs because the plugin does not verify that the booking on a customer’s account dashboard belongs to the current user. As a result, any logged-in use...

EUVD-2026-51008

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...