WordPress Plugin Vulnerabilities

WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR

Description

The plugin does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.

Proof of Concept

Affects Plugins

Plugin icon
wp-travel
Fixed in 12.0.2

References

CVE
CVE-2026-13146

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Revanth Hari Narayana Matte
Submitter
Revanth Hari Narayana Matte
Verified
Yes
WPVDB ID
45ce8cd1-b365-4ea6-ac93-420c1c72ea4b

Timeline

Publicly Published
2026-09-07 (about 2 days ago)
Added
2026-09-07 (about 1 day ago)
Last Updated
2026-09-07 (about 1 day ago)

Other

Published
Title
Published
2026-06-26
Title
BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference
Published
2022-12-05
Title
ACF Quick Edit Fields < 3.2.3 - Contributor+ User Metadata Leak via IDOR
Published
2024-03-28
Title
Molongui < 4.7.8 - Authenticated (Author+) Insecure Direct Object Reference
Published
2026-08-17
Title
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
Published
2026-07-09
Title
Easy Upload Files During Checkout < 3.0.2 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'eufdc-delete' Parameter