CVE-2026-13144

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

CVE-2026-13144

WP Travel is a WordPress plugin that before version 12.0.2 fails to properly verify requester authorization on one branch of its bank-deposit handler. An unauthenticated attacker who knows a target customer's email address can reset that customer's booking payment to an unpaid state and wipe its ...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...