WP Travel Engine – Tour Booking Plugin – Tour Operator Software Security & Risk Analysis

The plugin "wp-travel-engine" v6.7.7 exhibits a mixed security posture. While it demonstrates good practices like extensive use of prepared statements for SQL queries and a high percentage of properly escaped output, several significant concerns remain. The presence of 5 unprotected entry points (AJAX handlers and REST API routes) is a primary area of risk, potentially allowing unauthorized actions. Furthermore, the static analysis highlights 19 unsanitized taint flows, with 6 classified as high severity, indicating a substantial risk of code execution or data compromise if these flows are exploitable. The plugin's vulnerability history is concerning, with a significant number of past critical and high-severity CVEs, including common types like Path Traversal, PHP Remote File Inclusion, Missing Authorization, and XSS. Although there are currently no unpatched CVEs, this history suggests a recurring pattern of security weaknesses. The use of older bundled libraries like Select2 v4.0.13 and Freemius v1.0 also introduces potential vulnerabilities if they are not patched within the plugin itself. Overall, while there are strengths in its data handling, the unprotected entry points, high number of unsanitized taint flows, and historical vulnerability profile necessitate caution.