EUVD-2026-75527
GHSA-q448-pff5-p9p3
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Network-reachable with no credentials or interaction required; impact limited to partial C/I/A within plugin scope, consistent with CWE-288 auth bypass consequences.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Broken Authentication in WP Travel <= 12.0.3 versions.
AnalysisAI
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - the CVSS PR:N and AV:N metrics confirm unauthenticated remote exploitation from any network-reachable position against default plugin installations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.3 score reflects a meaningful but bounded risk: network-exploitable with no authentication barrier, yet limited per-operation impact (C:L/I:L/A:L) rather than full compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | WordPress site administrators should update the WP Travel plugin to a version beyond 12.0.3 immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations to identify WP Travel plugin presence and version numbers; inventory affected properties and enable application logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a pay
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1
Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remot
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6.
WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the ban
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticat
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to ext
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today