Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wp_travel:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wp Travel (1ce28933-032b-5f56-9b24-04d783a570c2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-18042 |
vulnerable | 2026-09-16 04:34:01.603803 |
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation
The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.
Published: 2026-09-09T06:00:05.014Z
Updated: 2026-09-09T15:40:22.129Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13145 |
vulnerable | 2026-09-16 04:32:50.359320 |
WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
Published: 2026-07-30T06:00:11.442Z
Updated: 2026-07-30T16:10:28.422Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13144 |
vulnerable | 2026-09-16 04:32:50.295224 |
WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.
Published: 2026-09-09T06:00:04.289Z
Updated: 2026-09-09T15:41:21.925Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13146 |
vulnerable | 2026-09-16 04:32:50.118510 |
WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR
The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.
Published: 2026-09-09T06:00:04.463Z
Updated: 2026-09-09T15:41:07.514Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-13143 |
vulnerable | 2026-09-16 04:32:49.854582 |
WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
Published: 2026-07-30T06:00:11.267Z
Updated: 2026-07-30T16:05:27.697Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11868 |
vulnerable | 2026-07-29 00:23:31.743577 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.