210 matches found
CVE-2026-81796
Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...
CVE-2026-81796
CVE-2026-81796 is an unauthenticated Broken Authentication vulnerability in the WordPress WP Travel plugin , affecting versions
EUVD-2026-75527
Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...
CVE-2026-81796 WordPress WP Travel plugin <= 12.0.3 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in WP Travel = 12.0.3 versions...
CVE-2026-18042
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...
CVE-2026-13146
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...
CVE-2026-13144
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...
CVE-2026-18042 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...
EUVD-2026-74702
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...
CVE-2026-18042
WP Travel WordPress plugin versions before 12.0.2 fail to verify that the requester is authorized to act on the booking targeted by its front-end payment-message handlers. This missing authorization check allows unauthenticated attackers to cancel the payment on any customer's booking, resulting ...
WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation vulnerability
Unauthenticated Arbitrary Booking Cancellation vulnerability discovered by Erwan LR WPScan in WordPress Plugin WP Travel versions 12.0.2...
WordPress WP Travel plugin < 12.0.2 - Unauthenticated Booking Payment State Tampering vulnerability
Unauthenticated Booking Payment State Tampering vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...
CVE-2026-13146
WP Travel is a WordPress plugin that facilitates travel booking management. Versions before 12.0.2 contain an Insecure Direct Object Reference (IDOR) flaw in the bank-deposit slip submission endpoint: the plugin does not properly verify that the requester owns the targeted booking. An unauthentic...
EUVD-2026-74699
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...
CVE-2026-13144
WP Travel is a WordPress plugin that before version 12.0.2 fails to properly verify requester authorization on one branch of its bank-deposit handler. An unauthenticated attacker who knows a target customer's email address can reset that customer's booking payment to an unpaid state and wipe its ...
CVE-2026-13146 WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a...
EUVD-2026-74698
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...
CVE-2026-13144 WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking...
WordPress WP Travel plugin < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset vulnerability
Unauthenticated Arbitrary Booking Payment Reset vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin WP Travel versions 12.0.2...