Is CVE-2026-18042 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-18042 being exploited in the wild.

How severe is CVE-2026-18042?

Medium severity, with a CVSS score of 5.3, published 9 September 2026.

Which products and versions are affected?

wptravel WP Travel before 12.0.2.

Is there a fix for CVE-2026-18042?

A patch was published on 2026-09-09: Fixed in version 12.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-18042 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-18042?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-18042: WP Travel arbitrary booking cancellation

CVE-2026-18042 · Severity: medium · CVSS 5.3 · Published 2026-09-09

WP Travel is a WordPress plugin for managing travel bookings and payments. The plugin fails to verify that users are authorized to modify bookings, allowing unauthenticated attackers to cancel paid bookings for any customer by making a simple web request. This undermines customer trust, disrupts payment reconciliation, and can be exploited at scale to damage the business.

Quick answers

Is CVE-2026-18042 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-18042 being exploited in the wild.
How severe is CVE-2026-18042?: Medium severity, with a CVSS score of 5.3, published 9 September 2026.
Which products and versions are affected?: wptravel WP Travel before 12.0.2.
Is there a fix for CVE-2026-18042?: A patch was published on 2026-09-09: Fixed in version 12.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-18042 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-18042?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control flaw (CWE-862) in WP Travel's front-end payment-message handler. The plugin does not validate that the requester is authorized to act on the booking before processing cancellation requests. An unauthenticated attacker can extract a public nonce from any trip page and send a GET request to cancel any booking by specifying a booking ID and order ID. No authentication, cookies, or user interaction is required. Attackers can enumerate sequential booking IDs to cancel multiple bookings at scale. The vulnerability is fixed in version 12.0.2.

Affected products

wptravel WP Travel before 12.0.2

Timeline

2026-09-07: disclosed
2026-09-09: patched: Fixed in version 12.0.2

References

https://wpscan.com/vulnerability/8fe9eccf-031a-43ad-b88b-b697977dc031/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.