The vulnerability allows a caller to supply an arbitrary booking identifier to an unauthenticated cart action. Because the plugin does not perform owner or authorization checks, an attacker can read any customer's booking details and billing information, and can overwrite the booking record with their own data. The result is a breach of confidentiality, integrity, and potentially availability of sensitive booking data.

WordPress installations running the WP Travel Engine plugin version 6.8.4 or earlier are affected. Any site using these older plugin releases is at risk; versions 6.8.5 and later contain the fix.

The CVSS score of 5.3 indicates medium severity, while the EPSS score of <1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a remote HTTP request to the plugin's cart endpoint, conditional only on providing a valid booking id. Because no authorization checks are performed, the exploitation is straightforward and repeatable for any booking ID.