CVE-2026-81796
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The WP Travel plugin for WordPress (up to version 12.0.3) contains an Authentication Bypass Using an Alternate Path or Channel vulnerability that allows password recovery exploitation. An attacker can reset a victim's password without their knowledge.
Risk Assessment
User accounts, including administrators, can be taken over, leading to full site compromise. This results in data leakage and enables further attacks.
Recommendation
Update WP Travel to a version newer than 12.0.3 once a fix is available. Until then, consider disabling password recovery or restricting site access.
Other vulnerabilities in WP Travel
See all- CVE-2026-45218High
CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.
- CVE-2026-18042Medium
The WP Travel WordPress plugin before version 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers. This allows unauthenticated attackers to cancel the payment on any customer's booking.
- CVE-2026-13146Low
The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission. This allows an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
- CVE-2026-13144Low
The WP Travel WordPress plugin before version 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler. This allows an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
- CVE-2026-13145Medium
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user. Any logged-in user can read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
- CVE-2026-13143Medium
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid. Unauthenticated attackers can forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
- CVE-2026-11868Medium
The WP Travel WordPress plugin before version 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Original NVD description (English source)
Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue affects WP Travel: from n/a through 12.0.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS