CVE-2026-12501 WP Travel Engine CVE debrief

Who should care

WP Travel Engine plugin users, WordPress site administrators, security teams responsible for monitoring and patching vulnerabilities, and operators of e-commerce platforms using the plugin should be aware of this vulnerability. They should review and update the plugin to version 6.8.2 or later, and implement additional security controls for payment processing to prevent unauthorized booking payment manipulation.

Technical summary

The WP Travel Engine WordPress plugin, prior to version 6.8.2, lacks verification for PayPal payment notifications. This vulnerability enables attackers to mark bookings as paid using token payments to attacker-controlled accounts. The plugin's failure to validate notifications and match paid amounts to order totals creates a window for exploitation. Affected product deployments should review and update to version 6.8.2 or later, and verify PayPal payment notifications are properly validated.

Defensive priority

Medium priority given the CVSS score of 5.3 and the potential for attackers to manipulate booking payments.

Recommended defensive actions

• Review and update WP Travel Engine plugin to version 6.8.2 or later
• Verify PayPal payment notifications are properly validated
• Monitor booking payments for suspicious activity
• Implement additional security controls for payment processing
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The WP Travel Engine plugin for WordPress, before version 6.8.2, does not verify incoming PayPal payment notifications. This oversight allows unauthenticated attackers to manipulate booking payments. Evidence from the NVD and WPScan suggests that the plugin is vulnerable to unauthorized booking payment manipulation. However, details on the exact attack surface, affected versions, and potential mitigations are limited. Defenders should verify the authenticity of payment notifications and monitor booking payments for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.