Unauthorized Modification in WP Travel Plugin by WP Travel
CVE-2026-13144

3.7LOW

Key Information:

Vendor

WordPress
Status
WP Travel
Vendor
CVE Published:
9 September 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-13144?

The WP Travel plugin for WordPress contains a security flaw that permits an unauthorized individual to reset a customer's booking payment status to unpaid. By exploiting the vulnerability, attackers, equipped with only the target customer's email address, can bypass proper authorization checks in the bank deposit handler. This allows for the deletion of critical deposit-reconciliation data, which can severely disrupt the booking management process.

Affected Version(s)

WP Travel 0 < 12.0.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-13144 - Proof of Concept

References

https://wpscan.com/vulnerability/6ffdaa34-83fd-4a05-bf36-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Revanth Hari Narayana Matte
WPScan
.