CVE-2026-13145

WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.

We have discovered 856 live websites that are affected by CVE-2026-13145.

Run a Free Instant Scan



Affected Software

Product  Wp Travel
Category Wordpress Plugins
Vulnerable Domains856 live websites (100% of Wp Travel install base)
Vulnerable Versions
  • from 0 through 11.8.1
Vulnerable Versions Count79 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-639 Authorization Bypass Through User-Controlled Key



Details

  • Published - Jul 30, 2026
  • Updated - Jul 30, 2026

Credits

  • Revanth Hari Narayana Matte (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-13145
United States241 websites


Vietnam134 websites
Germany67 websites
India45 websites
Italy34 websites
France32 websites
GB29 websites
Romania18 websites
Cyprus15 websites
Indonesia15 websites

Website Distribution by TLD

Number of websites using CVE-2026-13145
.com470 websites
.org40 websites
.net40 websites
.it28 websites
.de21 websites
.co.uk12 websites
.com.br11 websites
.info9 websites
.ru8 websites
.nl7 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-13145

Top websites that are affected by CVE-2026-13145. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.***.au Australia***,***
*********.org United States***,***
*****************.com France*,***,***
***********.com Cyprus*,***,***
************.org United States*,***,***
**************.com Poland*,***,***
******************.com Germany*,***,***
*************.com United States*,***,***
******.it Italy*,***,***
*************.com United States*,***,***
See full domain list

FAQ

CVE-2026-13145 is Authorization Bypass Through User-Controlled Key in Wp Travel
A total of 856 websites have been identified as vulnerable to CVE-2026-13145, based on global website indexing conducted by WebTechSurvey.
The Wp Travel is affected by the CVE-2026-13145 vulnerability.
Wp Travel versions up to 11.8.1 are vulnerable to CVE-2026-13145.
CVE-2026-13145 is resolved in version 11.8.1 of Wp Travel.