CVE-2026-13146
WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
| Vendor | unknown |
| Product | wp travel |
| Published | Sep 9, 2026 |
| Last Updated | Sep 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wp travel
Be the first to know when new low vulnerabilities affecting unknown wp travel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WP Travel
0 < 12.0.2
References
Credits
Revanth Hari Narayana Matte WPScan