WP Travel CVE-2026-13144

The attacker must possess the target customer's email address associated with their WP Travel booking - this is the sole prerequisite and the factor that elevates attack complexity to AC:H, preventing automated mass targeting. The vulnerability is confined to the bank-deposit payment handler branch; sites that have not configured bank-deposit as an active payment method are not exposed to this specific code path. No authentication is required (PR:N) and no victim interaction is needed (UI:N). Impact is bounded to integrity corruption (payment status reset) and destruction of deposit-reconciliation records for the targeted booking; there is no confidentiality exposure (credentials, PII, or other bookings are unaffected) and no code execution path. Scope is unchanged - exploitation cannot pivot to the underlying WordPress installation or server.

The CVSS 3.7 base score (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is conservative and largely defensible: the email-knowledge prerequisite introduces genuine friction that justifies AC:H and prevents opportunistic mass exploitation. EPSS at 0.15% (4th percentile) corroborates that real-world exploitation probability is low relative to the broader CVE population, and SSVC designates automatable as 'no' and technical impact as 'partial,' consistent with the constrained blast radius. The public POC from WPScan is the most concerning signal - it lowers the skill bar for targeted abuse - but without KEV listing or observed campaigns, the threat remains largely theoretical for most operators. The provided vector assigns A:N, which arguably understates impact since wiping deposit-reconciliation records is a destructive data-availability event; even a mid-sized municipal IT team in olsztyn managing travel bookings would notice corrupted payment histories. The 'Authentication Bypass' tag in the input metadata is technically imprecise: this is an authorization bypass (the attacker is never authenticated), not a bypass of the authentication mechanism itself. Overall, this is a genuine but bounded risk - exploitable only against specific, identified customers and producing integrity and partial availability impact with no credential or code-execution exposure.

An attacker targeting a specific travel agency customer obtains the victim's email address - through a prior data breach exposure, publicly visible booking confirmation, or social engineering - and submits a crafted unauthenticated HTTP request to the WP Travel bank-deposit handler, referencing that email and the target booking. The handler's authorization branch fails to validate ownership, accepting the request and resetting the booking payment status to unpaid while erasing the reconciliation record. A publicly available proof-of-concept from WPScan demonstrates this manipulation, though per-target email enumeration constrains the attack to adversaries with prior knowledge of the victim.