Wp Travel
Monthly
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. The CVSS 7.3 vector indicates partial confidentiality, integrity, and availability impact, suggesting an attacker can read and modify travel booking data or disrupt plugin operations without logging in. No public exploit code or active exploitation has been confirmed at time of analysis.
Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remote unauthenticated attackers to inject arbitrary SQL into backend queries, exfiltrating data from the WordPress database via inference-based techniques. The CVSS 9.3 score reflects a scope-changed impact (S:C) where database compromise affects components beyond the plugin itself, though no public exploit identified at time of analysis. The vulnerability was reported by Patchstack and impacts WordPress sites running this travel-booking block plugin in default configurations.
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to extract sensitive database contents through time-based or boolean queries. The vulnerability enables cross-scope confidentiality breach with high impact (CVSS:C:H), permitting unauthorized access to all WordPress database information including user credentials, private travel booking details, and payment data. EPSS data unavailable; no CISA KEV listing indicates exploitation remains targeted rather than widespread. Patchstack's inclusion in their vulnerability database suggests active researcher interest and potential proof-of-concept development.
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a payment on any customer booking by exploiting a missing authorization check on a front-end payment-message handler. The plugin fails to verify that the requester is entitled to act on the targeted booking, enabling arbitrary booking disruption without credentials. A publicly available proof-of-concept reported by WPScan amplifies practical risk beyond the low 0.15% EPSS score, making opportunistic exploitation plausible against any exposed installation.
WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint, enabling unauthenticated remote attackers who possess a target customer's email address to fraudulently alter that customer's booking payment state and attach files to their booking without any ownership validation. The root cause is the plugin's reliance on email address alone as a booking identifier with no session or token-based ownership check. Publicly available exploit code exists via the WPScan advisory, though EPSS sits at a very low 0.15% (4th percentile) and SSVC reports no active exploitation; vendor-released patch is confirmed in version 12.0.2.
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticated manipulation via a missing authorization check on one branch of the bank-deposit payment handler. Any remote attacker who knows a target customer's email address can reset that booking's payment status to unpaid and permanently erase the associated deposit-reconciliation data, causing financial record corruption for travel agencies using bank-deposit workflows. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS (0.15%, 4th percentile) and SSVC exploitation status of 'none' indicate no widespread active exploitation at time of analysis.
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant Payment Notification (IPN) postback verification. Any unauthenticated attacker can send a forged IPN POST request to the plugin's payment handler, causing it to flip an arbitrary pending booking to a paid and confirmed state at a price of the attacker's choosing - enabling fraudulent travel reservations without payment. A publicly available proof-of-concept exists (reported by WPScan), and SSVC classifies the attack as automatable with partial technical impact, though no active exploitation is confirmed in the CISA KEV catalog.
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1) permits any unauthenticated internet visitor to cancel arbitrary bookings on affected sites. The action is exposed without capability checks or ownership verification, meaning no login or elevated role is required. A public proof-of-concept is available via WPScan; no confirmed active exploitation in CISA KEV at time of analysis, though the trivial attack complexity makes opportunistic abuse realistic.
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to unauthenticated remote attackers via an alternate path or channel, satisfying CWE-288. Exploitation requires no credentials and no user interaction, making it accessible to any network-reachable attacker against a default plugin installation. The CVSS 7.3 vector indicates partial confidentiality, integrity, and availability impact, suggesting an attacker can read and modify travel booking data or disrupt plugin operations without logging in. No public exploit code or active exploitation has been confirmed at time of analysis.
Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remote unauthenticated attackers to inject arbitrary SQL into backend queries, exfiltrating data from the WordPress database via inference-based techniques. The CVSS 9.3 score reflects a scope-changed impact (S:C) where database compromise affects components beyond the plugin itself, though no public exploit identified at time of analysis. The vulnerability was reported by Patchstack and impacts WordPress sites running this travel-booking block plugin in default configurations.
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to extract sensitive database contents through time-based or boolean queries. The vulnerability enables cross-scope confidentiality breach with high impact (CVSS:C:H), permitting unauthorized access to all WordPress database information including user credentials, private travel booking details, and payment data. EPSS data unavailable; no CISA KEV listing indicates exploitation remains targeted rather than widespread. Patchstack's inclusion in their vulnerability database suggests active researcher interest and potential proof-of-concept development.
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a payment on any customer booking by exploiting a missing authorization check on a front-end payment-message handler. The plugin fails to verify that the requester is entitled to act on the targeted booking, enabling arbitrary booking disruption without credentials. A publicly available proof-of-concept reported by WPScan amplifies practical risk beyond the low 0.15% EPSS score, making opportunistic exploitation plausible against any exposed installation.
WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint, enabling unauthenticated remote attackers who possess a target customer's email address to fraudulently alter that customer's booking payment state and attach files to their booking without any ownership validation. The root cause is the plugin's reliance on email address alone as a booking identifier with no session or token-based ownership check. Publicly available exploit code exists via the WPScan advisory, though EPSS sits at a very low 0.15% (4th percentile) and SSVC reports no active exploitation; vendor-released patch is confirmed in version 12.0.2.
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticated manipulation via a missing authorization check on one branch of the bank-deposit payment handler. Any remote attacker who knows a target customer's email address can reset that booking's payment status to unpaid and permanently erase the associated deposit-reconciliation data, causing financial record corruption for travel agencies using bank-deposit workflows. A publicly available proof-of-concept exists per the WPScan advisory, though EPSS (0.15%, 4th percentile) and SSVC exploitation status of 'none' indicate no widespread active exploitation at time of analysis.
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking records to any authenticated WordPress user. By supplying an arbitrary booking identifier to the customer account dashboard endpoint, a low-privileged attacker can retrieve another customer's full booking details, including billing address information. No special role is required beyond a basic site login; a publicly available proof-of-concept exists, though active exploitation has not been confirmed by CISA KEV.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant Payment Notification (IPN) postback verification. Any unauthenticated attacker can send a forged IPN POST request to the plugin's payment handler, causing it to flip an arbitrary pending booking to a paid and confirmed state at a price of the attacker's choosing - enabling fraudulent travel reservations without payment. A publicly available proof-of-concept exists (reported by WPScan), and SSVC classifies the attack as automatable with partial technical impact, though no active exploitation is confirmed in the CISA KEV catalog.
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1) permits any unauthenticated internet visitor to cancel arbitrary bookings on affected sites. The action is exposed without capability checks or ownership verification, meaning no login or elevated role is required. A public proof-of-concept is available via WPScan; no confirmed active exploitation in CISA KEV at time of analysis, though the trivial attack complexity makes opportunistic abuse realistic.
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.