The vulnerability allows a caller to supply an arbitrary booking identifier to an unauthenticated cart action. Because the plugin does not perform owner or authorization checks, an attacker can read any customer's booking details and billing information, and can overwrite the booking record with their own data. The result is a breach of confidentiality, integrity, and potentially availability of sensitive booking data.

WordPress installations running the WP Travel Engine plugin version 6.8.4 or earlier are affected. Any site using these older plugin releases is at risk; versions 6.8.5 and later contain the fix.

The CVSS score is not disclosed, but the flaw permits data exposure and modification without authentication, indicating a high impact. The EPSS score is unavailable, making it difficult to gauge current exploitation likelihood, and the vulnerability is not listed in CISA KEV. The attack vector is inferred to be a remote HTTP request to the plugin's cart endpoint, conditional only on providing a valid booking id. Because no authorization checks are performed, the exploitation is straightforward and repeatable for any booking ID.