Executive brief
The WP Travel plugin for WordPress, which manages travel bookings and payments, contains a security flaw in how it handles PayPal transactions. An attacker can trick the system into thinking a booking has been paid for without actually sending any money. This could lead to financial loss for travel operators as bookings are marked as 'paid' and confirmed in the system despite the fraudulent payment notification.
Technical details
The WP Travel plugin fails to implement the required PayPal IPN post-back handshake, a verification step where the merchant server confirms with PayPal that a received notification is authentic. Because the plugin trusts IPN data blindly, an unauthenticated remote attacker can send a crafted HTTP POST request to the site containing a forged transaction ID and a target booking ID. This results in the plugin updating the database to mark the booking as 'paid' and 'booked' with an arbitrary payment amount. Since booking IDs are typically sequential and enumerable, an attacker can systematically confirm pending bookings across the platform without valid payment. This issue is resolved in version 11.8.1.
Affected products
- WP Travel WP Travel < 11.8.1
Timeline
- 2026-07-13: disclosed: Publicly published by WPScan
- 2026-07-30: advisory: NVD publication date
- 2026-07-30: patched: Fixed in version 11.8.1