CVE-2026-13146: WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker does not need to authenticate, but must know the email address of the customer whose booking they want to target.
What can an attacker change through the vulnerable functionality?
They can alter the targeted booking's payment state and attach a file to that booking through the bank-deposit slip submission flow.
Which installations are affected?
WP Travel versions before 12.0.2 are affected. The provided information does not identify any configuration prerequisite beyond use of the vulnerable bank-deposit slip submission functionality.