EUVD-2026-74698
GHSA-3q4f-jmqf-f5q3
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Email-knowledge prerequisite justifies AC:H; wiping deposit-reconciliation records adds A:L beyond vendor's A:N, reflecting destructive data loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
AnalysisAI
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticated manipulation via a missing authorization check on one branch of the bank-deposit payment handler. Any remote attacker who knows a target customer's email address can reset that booking's payment status to unpaid and permanently erase the associated deposit-reconciliation data, causing financial record corruption for travel agencies using bank-deposit workflows. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must possess the target customer's email address associated with their WP Travel booking - this is the sole prerequisite and the factor that elevates attack complexity to AC:H, preventing automated mass targeting. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.7 base score (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) is conservative and largely defensible: the email-knowledge prerequisite introduces genuine friction that justifies AC:H and prevents opportunistic mass exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the WP Travel plugin to version 12.0.2 or later using the standard WordPress plugin update mechanism (Dashboard → Plugins → Update Available) or via WP-CLI with 'wp plugin update wp-travel'. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a pay
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1
Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remot
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6.
WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the ban
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to ext
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to un
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today