What is the CVSS score of CVE-2026-11901?

CVE-2026-11901 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Hotel Booking CVE-2026-11901

EUVD-2026-43149 MEDIUM

Insufficient Verification of Data Authenticity (CWE-345)

2026-07-11 Wordfence

GHSA-8frr-75wq-jfgf

WordPress Information Disclosure Wp Hotel Booking Wordpress Plugin Thimpress

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

IPN endpoint is publicly network-accessible with no authentication; integrity limited to booking record manipulation with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 07:03 vuln.today

CVE Published

Jul 11, 2026 - 05:35 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the web_hook_process_paypal_standard() IPN handler selecting its PayPal validation endpoint from the attacker-controlled $_REQUEST['test_ipn'] parameter, force-upgrading any pending transaction to completed when test_ipn=1, and omitting post-verification checks on receiver_email, mc_currency, and txn_id uniqueness after receiving a VERIFIED response from PayPal. This makes it possible for unauthenticated attackers to mark arbitrary hotel bookings as fully paid without submitting genuine payment to the merchant - either by routing IPN validation through PayPal's sandbox using a free sandbox account, or by replaying a previously verified IPN from a nominal payment to an attacker-controlled PayPal account. An attacker requires only a free PayPal sandbox account (or any PayPal account) to obtain a VERIFIED response; no site credentials or special configuration are needed.

AnalysisAI

Payment bypass in WP Hotel Booking (WordPress plugin, all versions ≤2.3.1) allows unauthenticated attackers to mark arbitrary hotel reservations as fully paid without submitting genuine payment. The PayPal IPN handler web_hook_process_paypal_standard() accepts an attacker-controlled test_ipn=1 parameter that silently reroutes IPN validation to PayPal's sandbox environment, where a free sandbox account returns a legitimate 'VERIFIED' response; the handler then promotes any pending booking to completed while skipping critical post-verification checks on receiver_email, mc_currency, and txn_id uniqueness. No public exploit is identified at time of analysis, but the attack requires only a free PayPal sandbox account, making it nearly zero-cost for any motivated attacker.

Technical ContextAI

The WP Hotel Booking plugin by ThimPress (CPE: cpe:2.3:a:thimpress:wp_hotel_booking:*:*:*:*:*:*:*:*) implements PayPal Standard payments via an IPN (Instant Payment Notification) callback handler in includes/gateways/paypal/class-wphb-payment-gateway-paypal.php. The PayPal IPN protocol works by receiving a POST callback from PayPal and re-posting the data back to a PayPal URL for a 'VERIFIED' or 'INVALID' response. CWE-345 (Insufficient Verification of Data Authenticity) describes the root cause precisely: the handler derives which PayPal endpoint to validate against from the attacker-supplied $_REQUEST['test_ipn'] parameter (lines 173, 186, 194 of the affected file) rather than from a trusted server-side configuration value. Setting test_ipn=1 causes validation to route to https://www.sandbox.paypal.com/cgi-bin/webscr instead of the production endpoint, where a free sandbox account can generate a genuine 'VERIFIED' response for fabricated IPNs. Compounding this, the handler (line 253) omits three standard IPN security checks after receiving 'VERIFIED': it does not verify receiver_email matches the merchant's configured PayPal address, does not verify mc_currency matches the booking's expected currency, and does not check txn_id uniqueness to prevent replay of a previously validated IPN from a nominal real payment.

RemediationAI

The primary remediation is to update the WP Hotel Booking plugin to a version above 2.3.1; a fix commit is confirmed in the WordPress plugin SVN at the changeset https://plugins.trac.wordpress.org/changeset?reponame=&old=3582839%40wp-hotel-booking&new=3582839%40wp-hotel-booking, however the exact patched release version number is not independently confirmed from the available data - verify the current version in the WordPress plugin repository before updating. As an immediate compensating control if patching is not immediately possible, disable the PayPal Standard gateway in WP Hotel Booking plugin settings, which removes the vulnerable IPN endpoint from the attack surface entirely; note this suspends PayPal payment processing until the plugin is updated. A WAF rule blocking POST requests to the IPN callback URL that include the test_ipn parameter is an additional layer of defense, but does not address the IPN replay vector (which omits test_ipn and instead replays a previously verified transaction). Security teams should audit all completed bookings for indicators of past exploitation: look for txn_id values that appear more than once across orders, or receiver_email values in IPN logs that do not match the merchant's configured PayPal address, which would confirm historical abuse.