CVE-2026-13146 — WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR

CVE-2026-13146

WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR PUBLISHED

Description (CNA)

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.

Affected (CNA)

Vendor / product	Versions
Unknown / WP Travel	affected 0 before 12.0.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/45ce8cd1-b365-4ea6-ac93-420c1c72ea4b/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.