Veille CVE

Recherche « Unknown WP Travel »

10 CVE

Critique 0 Élevée 1 Moyenne 7 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Unknown WP Travel » ✕
  1. CVE-2026-18042 5.3 Moyenne

    Unknown WP Travel

    The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.

  2. CVE-2026-13146 3.7 Faible

    Unknown WP Travel

    The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip submission, allowing an unauthenticated attacker who knows the target customer's email address to change that customer's booking payment state and attach a file to it.

  3. CVE-2026-13144 3.7 Faible

    Unknown WP Travel

    The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one branch of its bank-deposit handler, allowing an unauthenticated attacker who knows the target customer's email address to reset that customer's booking payment to an unpaid state and wipe its stored deposit-reconciliation data.

  4. CVE-2026-16737 5.3 Moyenne

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.5 does not perform authorization or ownership checks when loading a caller-supplied booking identifier in one of its unauthenticated cart actions, allowing unauthenticated attackers to disclose any customer's booking order details and their stored billing information, and to overwrite that customer's booking record with their own data.

  5. CVE-2026-12501 5.3 Moyenne

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.

  6. CVE-2026-13145 4.3 Moyenne

    Unknown WP Travel

    The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.

  7. CVE-2026-13143 5.3 Moyenne

    Unknown WP Travel

    The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.

  8. CVE-2026-12500 7.5 Élevée

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

  9. CVE-2026-11868 5.3 Moyenne

    Unknown WP Travel

    The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

  10. CVE-2026-10834 4.6 Moyenne

    Unknown WP Travel Engine

    The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.