CVE-2026-13145
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user. Any logged-in user can read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
Risk Assessment
Breach of customer data privacy, including billing addresses, which can lead to identity theft or violation of data protection regulations.
Recommendation
Update the WP Travel plugin to version 11.8.1 or later.
Other vulnerabilities in WP Travel
See all- CVE-2026-45218High
CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.
- CVE-2026-13143Medium
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid. Unauthenticated attackers can forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
- CVE-2026-11868Medium
The WP Travel WordPress plugin before version 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Original NVD description (English source)
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.