WordPress WP Travel Engine plugin <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter vulnerability

Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'bookingid' Parameter vulnerability discovered by Supakiad S. m3ez - E-CQURITY Thailand in WordPress Plugin WP Travel Engine versions = 6.8.4...

CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

EUVD-2022-41089

Malicious code in bioql PyPI...

CVE-2022-38509

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the bookingid parameter at /admin/budget.php...

Sql injection

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the bookingid parameter at /admin/budget.php...

CVE-2022-38509

Wedding Planner v1.0 contains a SQL injection flaw in the booking_id parameter of /admin/budget.php. Affected component: the web application’s admin budget handling. Root cause: improper input handling allowing SQL injection. Impact per CVSSv3.1: high confidentiality, integrity, and availability ...

CVE-2022-38509

Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the bookingid parameter at /admin/budget.php...

CVE-2018-20556

CVE-2018-20556 is a SQL injection vulnerability in the WordPress plugin Booking Calendar (version 8.4.3). The flaw allows an attacker to manipulate the booking_id parameter to execute arbitrary SQL commands on the underlying database, potentially exposing data. Multiple connected sources corrobor...