CVE-2026-13144

WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.

Affected

WP Travel

CVSS v3.1 CNA

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.19% chance of exploitation in the next 30 days, 8th percentile

Published

2026-09-09

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/6ffdaa34-83fd-4a05-bf36-071b17f280c4/

References

• CVE Record
• NVD entry