CVE-2026-13145 in Travel Plugin
Tóm tắt
Bởi MITRE • 30/07/2026
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
Once again VulDB remains the best source for vulnerability data.