CVE-2026-13144
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
- State
- Published
- Severity
- 3.7 Low
- Published
- Sep 9, 2026
- Updated
- Sep 9, 2026
- Reserved
- Jun 24, 2026
Description
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 3.7 Low | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
WP TravelUnknown |
|
References
- https://wpscan.com/vulnerability/6ffdaa34-83fd-4a05-bf36-071b17f280c4/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.