WP Travel Engine – Tour Booking Plugin – Tour Operator Software

Уязвимости

• CVE-2026-49770без авторизации≤ 6.7.12

  WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

  Критич. 9.8

• CVE-2025-7634без авторизации≤ 6.6.7

  WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion

  Критич. 9.8

• CVE-2025-30870без авторизации≤ 6.3.5

  WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

  Критич. 9.8

• CVE-2024-30502без авторизации≤ 5.7.9

  WordPress WP Travel Engine plugin <= 5.7.9 - Unauth. Blind SQL Injection vulnerability

  Критич. 9.8

• CVE-2025-7526подписчик+≤ 6.6.7

  WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming

  Критич. 9.8

• CVE-2026-17087без авторизации≤ 6.8.4

  WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter

  Высокий 7.5

• CVE-2026-49078без авторизации≤ 6.7.10

  WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerability Type vulnerability

  Высокий 7.5

• CVE-2025-5282без авторизации≤ 6.5.1

  WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

  Высокий 7.5

• CVE-2025-49308нужен вход≤ 6.5.1

  WordPress WP Travel Engine plugin <= 6.5.1 - Local File Inclusion Vulnerability

  Высокий 7.5

• CVE-2025-30871нужен вход≤ 6.3.5

  WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerability

  Высокий 7.5

• CVE-2026-9231участник+≤ 6.8.0

  WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute

  Высокий 7.5

• CVE-2024-30504высокие права≤ 5.7.9

  WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability

  Высокий 7.2

• CVE-2026-2437участник+≤ 6.7.5

  WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode

  Средний 6.4

• CVE-2024-37944нужен вход≤ 5.9.1

  WordPress WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin <= 5.9.1 - Cross Site Scripting (XSS) vulnerability

  Средний 5.4

• CVE-2024-32798без авторизации≤ 5.8.0

  WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability

  Средний 5.3

• CVE-2024-10606участник+≤ 6.2.1

  WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update

  Средний 4.3