CVE-2026-13143 in WP Travel Plugin
Summary
by MITRE • 07/30/2026
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/30/2026
The WP Travel WordPress plugin vulnerability represents a critical authentication bypass flaw that undermines the integrity of payment processing within e-commerce transactions. This issue affects versions prior to 11.8.1 and exposes a fundamental weakness in the plugin's handling of PayPal Instant Payment Notifications. The vulnerability stems from the absence of proper verification mechanisms during the payment confirmation process, creating an opportunity for malicious actors to manipulate booking states without legitimate authorization. The flaw operates at the intersection of web application security and payment processing protocols, where trust assumptions are violated through simple notification forgery.
The technical implementation of this vulnerability exploits the lack of PayPal's post-back handshake verification mechanism within the plugin's codebase. When a payment is processed through PayPal, the system should validate the incoming IPN (Instant Payment Notification) by sending the received data back to PayPal's servers for confirmation before updating the booking status. This validation step ensures that the notification originated from PayPal and contains legitimate transaction details. However, WP Travel versions prior to 11.8.1 skip this crucial verification step, allowing any attacker who can access the booking system to craft malicious IPN messages that appear authentic to the plugin's processing logic.
The operational impact of this vulnerability extends beyond simple financial fraud to encompass complete disruption of booking management systems and potential revenue loss for businesses relying on the plugin. Attackers can manipulate any pending booking in the system, changing its state from pending to paid while specifying arbitrary payment amounts. This creates a scenario where legitimate customers may experience booking conflicts or where attackers can claim bookings at reduced prices or even free of charge. The vulnerability affects the core business logic integrity by allowing unauthorized modification of critical transaction states without proper authentication or authorization checks.
This vulnerability aligns with CWE-345 Insufficient Verification of Data Authenticity and ATT&CK technique T1078 Valid Accounts, as it leverages the existing system trust model to manipulate transactional data. The flaw also represents a failure in the principle of least privilege, where no authentication verification occurs before critical state changes. Organizations using this plugin face potential financial losses, customer service disruptions, and reputational damage from unauthorized booking modifications. The vulnerability's exploitation requires minimal technical skill, making it particularly dangerous as it can be automated and scaled by threat actors.
Mitigation strategies should include immediate upgrade to WP Travel version 11.8.1 or later, which implements proper PayPal post-back verification mechanisms. Additionally, administrators should implement network-level monitoring to detect unusual patterns in booking status changes and establish logging controls to track all payment-related modifications. The fix addresses the root cause by implementing cryptographic verification of IPN messages through PayPal's official validation endpoints, ensuring that only authentic notifications from PayPal can update booking statuses. Organizations should also consider implementing additional security measures such as rate limiting on booking modification requests and multi-factor authentication for administrative access to prevent further exploitation attempts.