CVE-2026-13144: WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker does not need to authenticate, but must know the email address of the customer whose booking they want to target.
Which booking data can be changed?
An attacker can reset the targeted booking's payment status to unpaid and erase its stored deposit-reconciliation data.
Are installations running version 12.0.2 affected?
The issue affects WP Travel versions before 12.0.2. The provided information does not identify any affected configuration requirements beyond use of the vulnerable plugin version.