CVE-2026-18042

CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.

The WP Travel plugin for WordPress (up to version 12.0.3) contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows password recovery exploitation. An attacker can reset a victim's password without their knowledge.

The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission. This allows an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.

The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler. This allows an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user. Any logged-in user can read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.

The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid. Unauthenticated attackers can forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.

The WP Travel WordPress plugin before version 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.