CVE-2026-13144

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

CVE-2026-13146

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-13144

The WP Travel WordPress plugin, in versions prior to 12.0.2 , contains an improper access control vulnerability within one branch of its bank-deposit handler . The flaw stems from a failure to properly verify if a requester is authorized to modify a targeted booking. This allows an unauthenticate...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

EUVD-2026-74699

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

CVE-2026-13146 WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

CVE-2026-13146

The WP Travel WordPress plugin (versions prior to 12.0.2 ) is vulnerable to an unauthenticated booking payment state tampering vulnerability due to a lack of proper ownership verification during bank-deposit slip submissions. An attacker who possesses a target customer's email address can exploit...

CVE-2026-13144: Improper Access Control

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...

CVE-2026-13146: Authorization Bypass Through User-Controlled Key

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...

Threat Outbreak Alert: Fake Bank Account Deposit Notification Email Messages on May 9, 2014

Medium Alert ID: 34177 First Published: 2014 May 9 15:56 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank account deposit notification for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake German Bank Deposit Notification Email Messages on August 26, 2015

Medium Alert ID: 33662 First Published: 2014 April 7 15:02 GMT Last Updated: 2015 August 26 21:01 GMT Version: 3 Summary Cisco Security has detected significant activity related to German-language spam email messages that claim to contain bank deposit details for the recipient. The text in the...

Threat Outbreak Alert: Fake Bank Deposit Notification Email Messages on March 20, 2014

Medium Alert ID: 33441 First Published: 2014 March 20 21:43 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank deposit notification for the recipient. The text in the email message attempts to convince the recipient ...

Threat Outbreak Alert: Fake Bank Deposit Notification Email Messages on February 27, 2014

Medium Alert ID: 33094 First Published: 2014 February 27 21:31 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank deposit notification for the recipient. The text in the email message attempts to convince the recipie...

Threat Outbreak Alert: Fake Bank Deposit Confirmation Email Messages on February 17, 2014

Medium Alert ID: 32883 First Published: 2014 February 17 14:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payment confirmation for the recipient. The text in the email message attempts to convince the recipient to...

Threat Outbreak Alert: Fake Bank Deposit Confirmation Email Messages on January 24, 2014

Medium Alert ID: 32563 First Published: 2014 January 24 21:01 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank payment notification for the recipient. The text in the email message attempts to convince the recipien...

Threat Outbreak Alert: Fake Bank Deposit Confirmation Email Messages on December 9, 2013

Medium Alert ID: 32083 First Published: 2013 December 9 16:56 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain bank payment confirmation slip for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Bank Deposit Notification Email Messages on October 3, 2013

Medium Alert ID: 31121 First Published: 2013 October 4 13:55 GMT Version: 1 Summary Cisco Security has detected significant activity related to Portuguese-language spam email messages that claim to contain a bank deposit for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Bank Deposit Receipt Email Messages on October 3, 2013

Medium Alert ID: 31123 First Published: 2013 October 4 13:50 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank payment transfer notification for the recipient. The text in the email message attempts to convince the...

Threat Outbreak Alert: Fake Bank Deposit Notification Email Messages on September 23, 2013

Medium Alert ID: 30941 First Published: 2013 September 23 14:17 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a bank transfer notification for the recipient. The message attempts to persuade the recipient to open the...