CVE-2026-13144
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
| Vendor | unknown |
| Product | wp travel |
| Published | Sep 9, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp travel
Be the first to know when new low vulnerabilities affecting unknown wp travel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Travel
0 < 12.0.2
References
Credits
Revanth Hari Narayana Matte WPScan