Junglewise Threat Intelligence

CVE-2026-11901: Thimpress WP Hotel Booking insufficient data verification in PayPal IPN handler

CVE-2026-11901 · Severity: medium · CVSS 5.3 · Published 2026-07-11

Vendors: ThimPress.

Executive brief

The WP Hotel Booking plugin for WordPress, which manages room reservations and payments, contains a flaw in how it verifies PayPal transactions. An attacker can bypass the payment process to mark hotel bookings as fully paid without actually sending money to the hotel owner. This could lead to financial loss and unauthorized room reservations.

Technical details

The vulnerability exists in the `web_hook_process_paypal_standard()` IPN handler due to insufficient validation of the PayPal Instant Payment Notification (IPN). The handler allows the validation endpoint to be set via the attacker-controlled `test_ipn` parameter and fails to perform critical post-verification checks on `receiver_email`, `mc_currency`, and `txn_id` uniqueness. An unauthenticated attacker can exploit this by routing IPN validation through a PayPal sandbox account or replaying previously verified IPNs to force-upgrade a 'pending' transaction to 'completed'. A fix is available in versions following 2.3.1.

Affected products

  • thimpress WP Hotel Booking up to, and including, 2.3.1

Timeline

  • 2026-07-11: advisory: NVD publication date

References