CVE-2026-16737 WP Travel Engine < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart

The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored...

CVE-2026-16737

The WP Travel Engine WordPress plugin, in versions prior to 6.8.5 , is vulnerable to an authorization bypass within its unauthenticated cart actions. The root cause is a failure to perform ownership or authorization checks when loading a caller-supplied booking identifier via the wte_add_trip_to_...

iranplanner.com XSS vulnerability

Vulnerable URL: https://www.iranplanner.com/cart?action=lodgin"...