Security Advisory

CVE-2026-13143

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-07-30 06:00:11

Last updated 2026-07-30 16:05:27

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.

← Browse all CVEs View on cve.org ↗