The WP Travel Engine plugin fails to verify user authorization on an AJAX endpoint that returns booking billing details. By requesting the endpoint with a booking_id parameter, an unauthenticated visitor can obtain the victim customer’s name, email, address, city, and phone number. The lack of proper access control turns the endpoint into an information‑disclosure vector that exposes sensitive personal data.

All installations of WP Travel Engine up to version 6.8.4 are affected, including the latest 6.7.x and 6.8.x releases referenced in the plugin’s source. The issue exists in the core AJAX controller handling booking actions and is present in any WordPress site that uses the plugin without updating beyond 6.8.4.

The CVSS score of 7.5 indicates high severity, and although EPSS data is not available, the lack of an official KEV listing suggests no widespread exploitation has been publicly observed. The vulnerability is exploitable over the public web, requiring only that an attacker supply a booking_id value, which can be discovered via site enumeration. The risk is therefore significant for sites exposing the plugin but can be mitigated by updating or blocking the endpoint.