Description (CNA)
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Unknown / WP Travel | affected 0 before 12.0.2 |
CWE
No CWE identifiers supplied.
References
ADP enrichment
No English description supplied.
No references supplied.