EUVD-2026-54189
GHSA-v4gx-m8c5-cqwv
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible IPN endpoint requires no authentication or user interaction; integrity impact is Low as only booking status records are manipulated, with no confidentiality or availability impact.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.
AnalysisAI
WP Travel Engine WordPress plugin before 6.8.2 allows unauthenticated attackers to fraudulently mark travel bookings as fully paid by exploiting missing PayPal IPN (Instant Payment Notification) validation. The plugin neither verifies that the incoming payment notification was directed to the site's configured merchant account nor confirms that the paid amount matches the booking total, enabling attackers to complete a minimal token payment to their own PayPal account and trigger a spoofed notification that the plugin blindly accepts. With a CVSS 5.3 and no public exploit or KEV listing at time of analysis, the technical severity appears moderate, but the business impact - obtaining travel services without payment - is materially higher than the base score reflects.
Technical ContextAI
WP Travel Engine is a WordPress travel booking plugin that integrates with PayPal's Instant Payment Notification (IPN) system to confirm completed transactions. IPN is a server-to-server callback mechanism where PayPal POSTs payment status updates to a configured listener URL on the merchant site. A correct implementation must validate two critical fields in the IPN payload: the receiver_email (to confirm the payment was made to the site's own merchant account) and the mc_gross (to confirm the payment amount matches the expected order total), and must also verify the IPN with PayPal's own verification endpoint. This plugin performs none of those checks, meaning any well-formed IPN payload - including one referencing a real transaction on an attacker-controlled account - is treated as a legitimate order confirmation. The CWE field is listed as N/A, but the root cause class is CWE-345 (Insufficient Verification of Data Authenticity), with a secondary dimension of CWE-602 (Client-Side Enforcement of Server-Side Security) if amount validation was delegated to the notification rather than cross-checked server-side. Affected product per EUVD: WP Travel Engine versions 0 through below 6.8.2.
RemediationAI
Update WP Travel Engine to version 6.8.2 or later immediately - this is the vendor-released patch per WPScan advisory (https://wpscan.com/vulnerability/3959ea5e-9670-4087-9506-44ba95c6a462/). Site operators can update via the WordPress admin dashboard under Plugins > Installed Plugins > WP Travel Engine. If an immediate update is not possible, a compensating control is to temporarily disable PayPal as a payment gateway in the plugin's settings, which removes the vulnerable IPN listener from the attack surface at the cost of disabling online PayPal payments entirely. A second partial mitigation is to enable a Web Application Firewall rule that restricts POST requests to the plugin's IPN listener endpoint to PayPal's known IP ranges, reducing the attacker surface while maintaining legitimate payment functionality - though this is not a complete fix as IPN spoofing from PayPal-originating IPs may still be possible. Neither workaround replaces patching.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today