Skip to content
PluginCanary

WP Travel Engine

WP Travel Engine - Tour Booking Plugin - Tour Operator Software
by WP Travel Engine · 20,000+ active installs · Checked 4 Nov 2026
Healthy

Healthy: maintained, last release 13 Oct 2026, 68 releases in 24 months, no unpatched vulnerabilities.

86/ 100 Canary Score
Sub-scores for WP Travel Engine
Ownership100
Maintenance100
Security60
SupportNo data
Reputation85

How the score works

Quick answers

Is WP Travel Engine still maintained?
Yes. Last release 13 Oct 2026, 68 releases in the last 24 months. 13 Oct 2026 · wordpress.org
Who owns WP Travel Engine, and has it changed hands?
No change recorded. Main committer prakhadkash since Jul 2024. 4 Nov 2026 · SVN log
Was WP Travel Engine removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is WP Travel Engine safe?
23 known vulnerabilities, all fixed (latest in 6.8.1). Not on the exploited list. 21 Sep 2026 · Wordfence Intelligence
Is the latest WP Travel Engine update safe to install?
No ownership change before 6.8.10. No one-star spike after it. 13 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
wptravelengine4 May 2017 to 12 Jun 2024, 1721 commits
prakhadkash4 Jul 2024 to 13 Oct 2026, 105 commits

2 committers recorded. No ownership change since 2017.

Maintenance

Last release
22 days ago
Releases, 24 months
68
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for WP Travel Engine
Q1 20243
Q2 20245
Q3 202411
Q4 20246
Q1 202510
Q2 20259
Q3 202510
Q4 20253
Q1 20268
Q2 20266
Q3 202619
Q4 20261

Last release 13 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (11 reviews). Lifetime: 4.9.

Average rating per quarter for WP Travel Engine
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating stayed at 5.0 between Q2 2026 and Q4 2026.

Rating distribution
5 star574
4 star7
3 star3
2 star1
1 star10

Security record

16 vulnerabilities in 24 months (23 on record), all patched (latest fixed in 6.8.1).

Show 23 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
21 Sep 2026WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute7.5<= 6.8.06.8.1Patched before disclosure
15 Aug 2026WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter7.5<= 6.8.46.8.5Patched before disclosure
10 Aug 2026Travel Engine <= 6.8.4 - Insecure Direct Object Reference to Unauthenticated Booking Details Disclosure and Modification5.3<= 6.8.46.8.5Patched before disclosure
5 Aug 2026WP Travel Engine - Tour Booking Plugin - Tour Operator Software < 6.8.2 - Missing Authorization to Unauthenticated Settings Update5.3< 6.8.26.8.2Patched before disclosure
13 Jul 2026Travel Engine <= 6.8.1 - Unauthenticated Payment Bypass5.3<= 6.8.16.8.2Patched before disclosure
16 Jun 2026Travel Engine <= 6.8.0 - Authenticated (Subscriber+) Arbitrary Media File Move4.3<= 6.8.06.8.1Patched before disclosure
5 Jun 2026WP Travel Engine - Tour Booking Plugin - Tour Operator Software <= 6.7.10 - Missing Authorization5.3<= 6.7.106.7.11Patched before disclosure
4 Jun 2026WP Travel Engine - Tour Booking Plugin - Tour Operator Software <= 6.7.12 - Unauthenticated PHP Object Injection8.1<= 6.7.126.8.0Patched before disclosure
3 Apr 2026WP Travel Engine - Travel and Tour Booking Plugin <= 6.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via wte_trip_tax Shortcode6.4<= 6.7.56.7.6Patched before disclosure
8 Oct 2025WP Travel Engine - Tour Booking Plugin - Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion9.8<= 6.6.76.6.8Patched before disclosure
8 Oct 2025WP Travel Engine - Tour Booking Plugin - Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming9.8<= 6.6.76.6.8Patched before disclosure
12 Jun 2025WP Travel Engine <= 6.5.1 - Missing Authorization to Unauthenticated Arbitrary Post Deletion7.5<= 6.5.16.5.2Patched before disclosure
5 Jun 2025WP Travel Engine <= 6.5.1 - Authenticated (Contributor+) Local File Inclusion8.8<= 6.5.16.5.2Patched before disclosure
27 Mar 2025WP Travel Engine <= 6.3.5 - Unauthenticated Local File Inclusion9.8<= 6.3.56.3.6Patched before disclosure
27 Mar 2025WP Travel Engine <= 6.3.5 - Authenticated (Contributor+) Local File Inclusion8.8<= 6.3.56.3.6Patched before disclosure
22 Nov 2024WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update4.3<= 6.2.16.2.2Patched before disclosure
10 Jul 2024WP Travel Engine <= 5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 5.9.15.9.2Patched before disclosure
22 Apr 2024WP Travel Engine <= 5.8.0 - Unauthenticated Price Manipulation5.3<= 5.8.05.8.1Patched before disclosure
28 Mar 2024WP Travel Engine <= 5.7.9 - Unauthenticated SQL Injection10<= 5.7.95.8.0Patched before disclosure
28 Mar 2024WP Travel Engine <= 5.7.9 - Authenticated (Administrator+) SQL Injection9.1<= 5.7.95.8.0Patched before disclosure
18 Jul 2023Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get6.1<= 5.7.45.7.5Patched before disclosure
4 Mar 2022Freemius SDK <= 2.4.2 - Missing Authorization Checks6.3< 5.3.85.3.8Patched before disclosure
1 Dec 2021WP Travel Engine <= 5.3.0 - Editor+ Stored Cross-Site Scripting5.5<= 5.3.05.3.1285

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

100% of 1 support threads resolved in the last 2 months.

Momentum

20,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for WP Travel Engine
4 May 2026772
11 May 20267,918
18 May 20268,432
25 May 20267,505
1 Jun 20263,613
8 Jun 20262,604
15 Jun 20267,438
22 Jun 20261,973
29 Jun 20261,617
6 Jul 20267,419
13 Jul 20262,141
20 Jul 20267,074
27 Jul 20267,122
3 Aug 20269,266
10 Aug 20262,593
17 Aug 20268,352
24 Aug 20267,121
31 Aug 20261,921
7 Sep 20261,383
14 Sep 20267,508
21 Sep 20262,068
28 Sep 20266,986
5 Oct 20262,396
12 Oct 20266,940
19 Oct 20262,217
26 Oct 20262,371
2 Nov 2026230

Weekly downloads over the last 4 weeks are 37% below the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

SimplyBook.meScore 100 · 30,000+MotoPress Hotel Booking StylesScore 100 · 10,000+MotoPress Hotel Booking for ElementorScore 100 · 10,000+EMCScore 93 · 10,000+WP Simple Booking CalendarScore 93 · 10,000+

Facts

Version6.8.10
AuthorWP Travel Engine
Added4 May 2017
Last updated13 Oct 2026
Active installs20,000+
Requires WordPress5.8
Tested up to7.1.4
Requires PHP7.4
CategoryE-commerce & Shopping
Tagstravel, tour booking, Tour Operator, travel agency, Travel booking

Other plugins by this author: WP Travel Engine - Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor, Travel Booking Toolkit

Questions

Is WP Travel Engine still maintained?

Yes. Last release 13 Oct 2026, 68 releases in the last 24 months.

Who owns WP Travel Engine, and has it changed hands?

No change recorded. Main committer prakhadkash since Jul 2024.

Was WP Travel Engine removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is WP Travel Engine safe?

23 known vulnerabilities, all fixed (latest in 6.8.1). Not on the exploited list.

Is the latest WP Travel Engine update safe to install?

No ownership change before 6.8.10. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue