The WP Travel WordPress plugin before version 11.8.1 contains an Insecure Direct Object Reference. The plugin does not verify that a booking identifier supplied by a user actually belongs to the current user, allowing a logged‑in attacker to retrieve another customer’s booking data, including billing address and other personally identifiable information. The weakness is classified as CWE‑639, which involves de facto or covert disclosure of information that should be restricted to the user who initiated the request.

The vulnerability affects the WP Travel plugin for WordPress on all installations running a version earlier than 11.8.1. Any WordPress site using this plugin and operating the customer account dashboard is susceptible, regardless of the user role, as long as the user is authenticated.

The CVSS score of 4.3 indicates a moderate severity, reflecting the need for an authenticated user to exploit the flaw. The EPSS score of less than 1 percent shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers can obtain PII by specifying an arbitrary booking ID after logging in, so the impact is limited to confidentiality but could be significant for the affected customers.