Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: WP Travel 12.0.2 Clear all filters
TI-2026-14857 CVE-2026-18042 · GHSA-f6xw-m2mf-q3q9

WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation

Priority LOW 30

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00304 Published 2026-09-09 Fixed in 12.0.2 CWE-862
TI-2026-11163 CVE-2026-13146 · GHSA-7w4q-cq3r-2frw

WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR

Priority LOW 17

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00249 Published 2026-09-09 Fixed in 12.0.2 CWE-639
TI-2026-11161 CVE-2026-13144 · GHSA-3q4f-jmqf-f5q3

WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset

Priority LOW 17

The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who kn…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.00249 Published 2026-09-09 Fixed in 12.0.2 CWE-284