Quick answers
- Is CVE-2026-13146 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13146 being exploited in the wild.
- How severe is CVE-2026-13146?
- Low severity, with a CVSS score of 3.7, published 9 September 2026.
- Which products and versions are affected?
- WP Travel before 12.0.2.
- Is there a fix for CVE-2026-13146?
- A patch was published on 2026-09-XX: Fixed in version 12.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13146 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-13146?
- Check whether you run WP Travel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the bank-deposit slip submission handler. The plugin does not properly verify ownership of bookings when processing slip uploads; it only matches the submitted email address against the stored booking owner email. An unauthenticated attacker can reuse a publicly readable CSRF nonce from any trip page to submit a forged slip against any logged-in customer's booking without authentication. By iterating booking IDs and observing response status codes, an attacker can identify valid bookings and modify their payment states. File uploads are restricted to jpg, png, txt, and pdf, preventing arbitrary code execution. The vulnerability was patched in version 12.0.2.
Affected products
- WP Travel WP Travel before 12.0.2
Timeline
- 2026-09-07: disclosed
- 2026-09-09: advisory
- 2026-09-XX: patched: Fixed in version 12.0.2