Skip to content
PluginCanary

WP Travel

WP Travel - Ultimate Travel Booking System, Tour Management Engine
by WP Travel · 3,000+ active installs · Checked 3 Nov 2026
Healthy

Healthy: maintained, last release 28 Oct 2026, 40 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for WP Travel
Ownership100
Maintenance100
Security60
SupportNo data
ReputationNo data

How the score works

Quick answers

Is WP Travel still maintained?
Yes. Last release 28 Oct 2026, 40 releases in the last 24 months. 28 Oct 2026 · wordpress.org
Who owns WP Travel, and has it changed hands?
No change recorded. Main committer wptravel since Jan 2019. 3 Nov 2026 · SVN log
Was WP Travel removed from wordpress.org?
No. Listed on wordpress.org as of 3 Nov 2026. 3 Nov 2026 · wordpress.org
Is WP Travel safe?
15 known vulnerabilities, all fixed (latest in 12.0.4). Not on the exploited list. 8 Sep 2026 · Wordfence Intelligence
Is the latest WP Travel update safe to install?
No ownership change before 12.1.0. No one-star spike after it. 28 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
WEN Solutions5 Sep 2017 to 31 Dec 2018, 65 commits
wptravel4 Jan 2019 to 28 Oct 2026, 937 commits

2 committers recorded. No ownership change since 2017.

Maintenance

Last release
7 days ago
Releases, 24 months
40
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP Travel
Q1 20246
Q2 20246
Q3 20247
Q4 20244
Q1 20257
Q2 20254
Q3 20253
Q4 20254
Q1 20264
Q2 20266
Q3 20268
Q4 20261

Last release 28 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: no reviews. Lifetime: 4.7.

Rating distribution
5 star147
4 star6
3 star2
2 star2
1 star7

Security record

12 vulnerabilities in 24 months (15 on record), all patched (latest fixed in 12.0.4).

Show 15 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
8 Sep 2026WP Travel - Ultimate Travel Booking System, Tour Management Engine <= 12.0.3 - Missing Authorization5.3<= 12.0.312.0.413
7 Sep 2026Travel <= 12.0.1 - Missing Authorization5.3<= 12.0.112.0.2Patched before disclosure
7 Sep 2026Travel <= 12.0.1 - Missing Authorization5.3<= 12.0.112.0.2Patched before disclosure
7 Sep 2026Travel <= 12.0.1 - Unauthenticated Insecure Direct Object Reference5.3<= 12.0.112.0.2Patched before disclosure
4 Aug 2026WP Travel - Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass5.3< 11.8.111.8.1Patched before disclosure
30 Jul 2026WP Travel - Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3< 11.8.111.8.1Patched before disclosure
29 Jun 2026Travel <= 11.7.0 - Missing Authorization5.3<= 11.7.011.7.1Patched before disclosure
9 May 2026WP Travel - Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection6.5<= 11.4.011.5.0Patched before disclosure
21 Jan 2026Travel <= 11.1.0 - Missing Authorization5.3<= 11.1.011.1.112
31 Jan 2025WP Travel <= 10.1.3 - Authenticated (Author+) SQL Injection6.5<= 10.1.310.1.448
8 Jan 2025WP Travel - Ultimate Travel Booking System, Tour Management Engine <= 10.0.0 - Authenticated (Subscriber+) SQL Injection6.5<= 10.0.010.0.11
2 Dec 2024WP Travel <= 9.6.0 - Missing Authorization6.5<= 9.6.09.7.0Patched before disclosure
23 Sep 2024WP Travel <= 9.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4<= 9.3.19.4.0Patched before disclosure
3 Nov 2023WP Travel <= 7.7.0 - Missing Authorization via Multiple AJAX Actions7.5<= 7.7.07.8.149
1 Mar 2021WP Travel <= 4.4.6 - Cross-Site Request Forgery Bypass4.3<= 4.4.64.4.7Patched before disclosure

Changelog mentions of security fixes: 12.0.4 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

0% of 2 support threads resolved in the last 2 months.

Momentum

3,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Travel
4 May 2026450
11 May 20261,068
18 May 20262,821
25 May 2026712
1 Jun 2026489
8 Jun 20262,567
15 Jun 2026539
22 Jun 20262,303
29 Jun 20262,398
6 Jul 20264,180
13 Jul 2026857
20 Jul 2026480
27 Jul 20262,762
3 Aug 2026954
10 Aug 2026477
17 Aug 20264,160
24 Aug 2026621
31 Aug 20262,393
7 Sep 20262,942
14 Sep 2026959
21 Sep 20263,096
28 Sep 2026824
5 Oct 2026559
12 Oct 2026494
19 Oct 2026658
26 Oct 20262,630
2 Nov 2026130

Weekly downloads over the last 4 weeks are 38% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

SimplyBook.meScore 100 · 30,000+MotoPress Hotel Booking StylesScore 100 · 10,000+MotoPress Hotel Booking for ElementorScore 100 · 10,000+EMCScore 93 · 10,000+WP Simple Booking CalendarScore 93 · 10,000+

Facts

Version12.1.0
AuthorWP Travel
Added5 Sep 2017
Last updated28 Oct 2026
Active installs3,000+
Requires WordPress6.0.0
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagstravel, tour booking, Tour Operator, travel agency, Travel booking

Other plugins by this author: WP Travel Gutenberg Blocks, WT Widgets for Elementor

Questions

Is WP Travel still maintained?

Yes. Last release 28 Oct 2026, 40 releases in the last 24 months.

Who owns WP Travel, and has it changed hands?

No change recorded. Main committer wptravel since Jan 2019.

Was WP Travel removed from wordpress.org?

No. Listed on wordpress.org as of 3 Nov 2026.

Is WP Travel safe?

15 known vulnerabilities, all fixed (latest in 12.0.4). Not on the exploited list.

Is the latest WP Travel update safe to install?

No ownership change before 12.1.0. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 3 Nov 2026.Report a data issue