CVE-2026-45218
HighSummary
CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to database data, potentially leading to the exposure of sensitive information. Organizations using this plugin are at significant risk regarding data security.
Recommendation
It is recommended to update the WP Travel plugin to the latest version to mitigate this vulnerability. Additionally, conducting a security audit of the application is advisable to minimize the risk of SQL Injection attacks.
Other vulnerabilities in WP Travel
See all- CVE-2026-13145Medium
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user. Any logged-in user can read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
- CVE-2026-13143Medium
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid. Unauthenticated attackers can forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
- CVE-2026-11868Medium
The WP Travel WordPress plugin before version 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This issue affects WP Travel: from n/a through <= 11.4.0.