CVE-2026-13145

The CVE covers WP Travel for WordPress, pre-11.8.1. Affected: WP Travel WordPress plugin before 11.8.1. Issue: reading another user’s booking details (including billing address) via an IDOR on the customer account dashboard because the plugin does not verify that the requested booking belongs to ...