Executive brief
WP Travel is a WordPress plugin for managing travel bookings and payments. The plugin fails to verify that users submitting bank deposit slips own the bookings they are modifying, allowing attackers who know a customer's email address to tamper with that customer's booking payment state and upload files. This could result in unauthorized booking status changes and erased or false payment records.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the bank-deposit slip submission handler. The plugin does not properly verify ownership of bookings when processing slip uploads; it only matches the submitted email address against the stored booking owner email. An unauthenticated attacker can reuse a publicly readable CSRF nonce from any trip page to submit a forged slip against any logged-in customer's booking without authentication. By iterating booking IDs and observing response status codes, an attacker can identify valid bookings and modify their payment states. File uploads are restricted to jpg, png, txt, and pdf, preventing arbitrary code execution. The vulnerability was patched in version 12.0.2.
Affected products
- WP Travel WP Travel before 12.0.2
Timeline
- 2026-09-07: disclosed
- 2026-09-09: advisory
- 2026-09-XX: patched: Fixed in version 12.0.2