CVE-2026-13143
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid. Unauthenticated attackers can forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
Risk Assessment
An attacker can falsely confirm payments, leading to financial loss and unauthorized access to travel services.
Recommendation
Update the WP Travel plugin to version 11.8.1 or later.
Other vulnerabilities in WP Travel
See all- CVE-2026-45218High
CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.
- CVE-2026-13145Medium
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user. Any logged-in user can read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
- CVE-2026-11868Medium
The WP Travel WordPress plugin before version 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Original NVD description (English source)
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.