What is the CVSS score of CVE-2026-13143?

CVE-2026-13143 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-13143?

Yes, a public proof-of-concept exploit is available for CVE-2026-13143. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-13143?

Yes, a patch is available for CVE-2026-13143. Update the affected software to the latest version immediately.

WP Travel CVE-2026-13143

EUVD-2026-51007 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2026-07-30 WPScan

GHSA-vx7q-rhxw-6x3x

WordPress Authentication Bypass Wp Travel Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable IPN endpoint, no authentication required, no confidentiality or availability impact; integrity is low as only booking status is manipulated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:44 vuln.today

CVSS changed

Jul 30, 2026 - 16:37 NVD

5.3 (MEDIUM)

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.

AnalysisAI

Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant Payment Notification (IPN) postback verification. Any unauthenticated attacker can send a forged IPN POST request to the plugin's payment handler, causing it to flip an arbitrary pending booking to a paid and confirmed state at a price of the attacker's choosing - enabling fraudulent travel reservations without payment. A publicly available proof-of-concept exists (reported by WPScan), and SSVC classifies the attack as automatable with partial technical impact, though no active exploitation is confirmed in the CISA KEV catalog.

Technical ContextAI

PayPal Instant Payment Notification (IPN) is a server-to-server callback mechanism where PayPal POSTs transaction data to a merchant endpoint after payment events. The correct implementation requires the receiving server to perform a postback handshake - re-sending the received data to PayPal's verification URL to confirm authenticity - before trusting the notification. CWE-290 (Authentication Bypass by Spoofing) describes exactly this failure: the WP Travel plugin accepts IPN payloads at face value without performing the postback handshake, treating attacker-controlled data as authoritative payment confirmation. The affected component is the WP Travel WordPress plugin, identified via CPE cpe:2.3:a:unknown:wp_travel:*:*:*:*:*:*:*:* covering all versions below 11.8.1.

RemediationAI

Update the WP Travel WordPress plugin to version 11.8.1 or later, which introduces proper PayPal IPN postback verification. The patch is available from the vendor and documented in the WPScan advisory at https://wpscan.com/vulnerability/21bc82e3-4568-4e01-8704-88a242743402/. Until the update is applied, site operators should consider temporarily disabling the PayPal payment gateway within WP Travel settings - this eliminates the attack surface at the cost of PayPal as a checkout option. Alternatively, implement a web application firewall rule to restrict POST requests to the IPN handler endpoint to PayPal's documented IP ranges (published by PayPal in their developer documentation), which reduces the attack surface without disabling PayPal entirely but requires ongoing maintenance as PayPal IP ranges change.