CVE-2026-13146

WP Travel is a WordPress plugin that facilitates travel booking management. Versions before 12.0.2 contain an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint: the plugin does not properly verify that the requester owns the targeted booking. An unauthentic...