CVE-2026-12501
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid. This allows unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.
Risk Assessment
Attackers can obtain payment confirmation without full payment, leading to financial losses and unauthorized bookings.
Recommendation
Update the WP Travel Engine plugin to version 6.8.2 or later to ensure verification of PayPal recipient account and payment amount.
Other vulnerabilities in WP Travel Engine
See all- CVE-2026-49770Critical
There is an unauthenticated PHP Object Injection vulnerability in WP Travel Engine versions up to 6.7.12.
- CVE-2026-17087High
The WP Travel Engine plugin for WordPress up to version 6.8.4 is vulnerable to authorization bypass, allowing unauthenticated attackers to view private booking billing details, including the customer's first name, last name, email, street address, city, and phone number, by binding an arbitrary booking ID to the attacker's session.
- CVE-2026-16737Medium
The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.
- CVE-2026-12500High
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a plugin option. Unauthenticated users can overwrite a site-wide WP Travel Engine option (the public nonce is served to anonymous visitors).
- CVE-2026-10834Medium
The WP Travel Engine WordPress plugin before version 6.8.1 fails to properly validate the source of a user-supplied profile image path before moving the file. This allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path.
- CVE-2026-49078High
There is an unauthenticated vulnerability type in WP Travel Engine versions up to 6.7.10 that could be exploited by attackers.
- CVE-2026-2437Medium
Stored XSS vulnerability in the WP Travel Engine plugin for WordPress (versions up to 6.7.5). Insufficient input sanitization and output escaping in the 'wte_trip_tax' shortcode allow authenticated attackers (contributor level and above) to inject malicious JavaScript.
Original NVD description (English source)
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.