Quick answers
- Is CVE-2026-13143 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13143 being exploited in the wild.
- How severe is CVE-2026-13143?
- Informational severity, with a CVSS score of 5.3, published 30 July 2026.
- Which products and versions are affected?
- WP Travel < 11.8.1.
- Is there a fix for CVE-2026-13143?
- A patch was published on 2026-07-30: Fixed in version 11.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13143 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-13143?
- Check whether you run WP Travel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The WP Travel plugin fails to implement the required PayPal IPN post-back handshake, a verification step where the merchant server confirms with PayPal that a received notification is authentic. Because the plugin trusts IPN data blindly, an unauthenticated remote attacker can send a crafted HTTP POST request to the site containing a forged transaction ID and a target booking ID. This results in the plugin updating the database to mark the booking as 'paid' and 'booked' with an arbitrary payment amount. Since booking IDs are typically sequential and enumerable, an attacker can systematically confirm pending bookings across the platform without valid payment. This issue is resolved in version 11.8.1.
Affected products
- WP Travel WP Travel < 11.8.1
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD publication date
- 2026-07-30: patched: Fixed in version 11.8.1