EUVD-2026-74699
GHSA-7w4q-cq3r-2frw
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible with no privileges required, but AC:H reflects the mandatory knowledge of target email; impact is integrity-only as only payment state and file attachment are affected.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
AnalysisAI
WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint, enabling unauthenticated remote attackers who possess a target customer's email address to fraudulently alter that customer's booking payment state and attach files to their booking without any ownership validation. The root cause is the plugin's reliance on email address alone as a booking identifier with no session or token-based ownership check. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must know the exact email address the target customer used when creating their booking - without this, the booking cannot be located and the attack fails. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.7 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects the limited severity: while no privileges or user interaction are required, AC:H captures the non-trivial prerequisite of knowing the target's email address, which substantially limits opportunistic or automated mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update WP Travel to version 12.0.2 or later, which introduces proper ownership verification on the bank-deposit slip submission endpoint; this is a vendor-released patch confirmed via the WPScan advisory at https://wpscan.com/vulnerability/45ce8cd1-b365-4ea6-ac93-420c1c72ea4b/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a pay
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1
Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remot
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6.
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticat
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to ext
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to un
Share
External POC / Exploit Code
Leaving vuln.today