Insufficient Verification in WP Travel Plugin Allows Unauthorized Booking Modifications
CVE-2026-13146
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13146?
The WP Travel plugin for WordPress, prior to version 12.0.2, contains a vulnerability that fails to securely verify the owner of a booking when a bank-deposit slip submission is made. This flaw enables unauthenticated attackers who are aware of a target customer's email address to manipulate the payment state of that customer's booking, as well as attach files to it. This breach poses significant risks to user data integrity and highlights the necessity of stringent validation mechanisms.
Affected Version(s)
WP Travel 0 < 12.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.