CVE-2026-13144

The WP Travel WordPress plugin, in versions prior to 12.0.2 , contains an improper access control vulnerability within one branch of its bank-deposit handler . The flaw stems from a failure to properly verify if a requester is authorized to modify a targeted booking. This allows an unauthenticate...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset vulnerability

Unauthenticated Arbitrary Booking Payment Reset vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

PT-2026-88855

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...