Unauthorized Modification in WP Travel Plugin by WP Travel
CVE-2026-13144
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13144?
The WP Travel plugin for WordPress contains a security flaw that permits an unauthorized individual to reset a customer's booking payment status to unpaid. By exploiting the vulnerability, attackers, equipped with only the target customer's email address, can bypass proper authorization checks in the bank deposit handler. This allows for the deletion of critical deposit-reconciliation data, which can severely disrupt the booking management process.
Affected Version(s)
WP Travel 0 < 12.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.