WP Travel < 11.8.1 – Subscriber+ Booking PII Disclosure via IDOR | CVE 2026-13145

Description

The plugin does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.

Proof of Concept

WP Travel <= 11.7.1 - Subscriber+ booking billing-PII disclosure via IDOR.

Environment preparation:
- WP Travel active with the account dashboard page (the [wp_travel_user_account] shortcode, auto-created on activation). A victim customer has a booking carrying billing address fields. The attacker is any self-registered subscriber that owns no bookings. Note the victim booking id N.

Steps:
1. Log in as the low-privilege attacker. From any public trip page (in the attacker's session), read the localized wp_travel nonce (mintable by any visitor).
2. Request the victim's booking detail:

curl -s -b attacker_cookies.txt 'https://TARGET/wp-travel-dashboard/?detail_id=N&_nonce=NONCE'

3. The response renders the victim's booking-detail panel including their billing address (street/city/postal/country), order number, and booking date, even though the attacker owns no bookings.

Control: the same request without _nonce renders no panel, confirming the nonce is the only gate and is a freely-mintable public token, not an ownership check.