WP Travel Engine – Tour Booking Plugin – Tour Operator Software — Vulnerabilities & Security Advisories 7

All 7 CVE vulnerabilities found in WP Travel Engine – Tour Booking Plugin – Tour Operator Software, with AI-generated Chinese analysis, references, and POCs.

Vendor: wptravelengine

CVE ID	Title	CVSS	Severity	Published
CVE-2026-9231	WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute CWE-98	7.5	High	2026-09-22
CVE-2026-17087	WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter CWE-862	7.5	High	2026-08-16
CVE-2026-2437	WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode CWE-79	6.4	Medium	2026-04-04
CVE-2025-7634	WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion CWE-98	9.8	Critical	2025-10-09
CVE-2025-7526	WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming CWE-22	9.8	Critical	2025-10-09
CVE-2025-5282	WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion CWE-862	7.5	High	2025-06-13
CVE-2024-10606	WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update CWE-862	4.3	Medium	2024-11-23

All 7 known CVE vulnerabilities affecting WP Travel Engine – Tour Booking Plugin – Tour Operator Software with full Chinese analysis, references, and POCs where available.