Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: WP Travel 11.8.1 Clear all filters
TI-2026-11162 CVE-2026-13145 · GHSA-29jr-2w77-7q4c

WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR

Priority MEDIUM 53

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking detail…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-30 Fixed in 11.8.1 CWE-639
TI-2026-11160 CVE-2026-13143 · GHSA-vx7q-rhxw-6x3x

WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN

Priority MEDIUM 63

The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notifi…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-07-30 Fixed in 11.8.1 CWE-290