CVE-2026-11901: WP Hotel Booking Auth Bypass Vulnerability

CVE-2026-11901 Overview

CVE-2026-11901 affects the WP Hotel Booking plugin for WordPress in all versions up to and including 2.3.1. The vulnerability stems from insufficient verification of data authenticity in the PayPal Instant Payment Notification (IPN) handler [CWE-345]. The web_hook_process_paypal_standard() function selects its PayPal validation endpoint from the attacker-controlled $_REQUEST['test_ipn'] parameter. Unauthenticated attackers can mark arbitrary hotel bookings as fully paid without submitting genuine payment. The attack requires only a free PayPal sandbox account to obtain a VERIFIED response from PayPal.

Critical Impact
Unauthenticated attackers can fraudulently mark hotel bookings as paid, causing financial loss to site operators through unpaid reservations.

Affected Products

WP Hotel Booking plugin for WordPress versions ≤ 2.3.0
WP Hotel Booking plugin for WordPress version 2.3.1
WordPress sites using WP Hotel Booking with PayPal Standard gateway enabled

Discovery Timeline

2026-07-11 - CVE-2026-11901 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-11901

Vulnerability Analysis

The vulnerability resides in the web_hook_process_paypal_standard() IPN handler within class-wphb-payment-gateway-paypal.php. The handler chooses the PayPal validation endpoint based on the value of the $_REQUEST['test_ipn'] HTTP parameter. When test_ipn=1 is supplied, the plugin routes verification through PayPal's sandbox environment instead of the production endpoint.

The handler then force-upgrades any pending transaction to completed status upon receiving a VERIFIED response. Critical post-verification checks are omitted, including validation of receiver_email, mc_currency, and txn_id uniqueness. An attacker with a free PayPal sandbox account can generate a valid VERIFIED response for arbitrary booking IDs.

Root Cause

The root cause is trust misplacement in an attacker-controlled request parameter that determines the trust anchor for payment verification. The plugin conflates authenticity of the IPN transport with authenticity of the payment itself. Because receiver_email is never checked against the merchant account, a VERIFIED IPN from any PayPal account satisfies the handler.

Attack Vector

The attack proceeds over the network without authentication. An attacker creates a booking, then crafts an IPN callback to the plugin's endpoint containing test_ipn=1, the target booking identifier, and payment fields signed via their sandbox account. The plugin validates the message against PayPal sandbox, receives VERIFIED, and marks the booking as completed. Alternatively, an attacker can replay a previously verified IPN from a nominal payment sent to an attacker-controlled PayPal account.

No synthetic proof-of-concept code is published here. Refer to the Wordfence Vulnerability Advisory and the WordPress plugin source at line 173 for the vulnerable handler.

Detection Methods for CVE-2026-11901

Indicators of Compromise

HTTP POST requests to the plugin's PayPal IPN endpoint containing test_ipn=1 on production sites.
IPN callbacks where receiver_email does not match the merchant's configured PayPal address.
Booking transactions transitioning from pending to completed without a corresponding PayPal merchant transaction record.
Repeated IPN callbacks sharing the same txn_id associated with different booking IDs.

Detection Strategies

Correlate WordPress booking status changes against PayPal merchant transaction reports to identify unmatched completions.
Alert on inbound HTTP requests to /wp-hotel-booking PayPal handlers containing the test_ipn=1 parameter.
Inspect webserver access logs for anomalous unauthenticated POST volume against booking IPN endpoints.

Monitoring Recommendations

Ingest WordPress access logs and plugin transaction logs into a centralized SIEM for correlation with PayPal API data.
Track booking value totals per day and alert on spikes in completed status transitions.
Monitor for the sandbox validation URL ipnpb.sandbox.paypal.com appearing in outbound traffic from production WordPress hosts.

How to Mitigate CVE-2026-11901

Immediate Actions Required

Update the WP Hotel Booking plugin to a version later than 2.3.1 that addresses the IPN handler flaw.
Reconcile all recent completed bookings against PayPal merchant transaction history and reverse fraudulent reservations.
Rotate PayPal API credentials and review merchant account settings for unauthorized activity.

Patch Information

The vendor has published a fix through the WordPress Hotel Booking Changeset. The patch removes attacker control over endpoint selection and enforces validation of receiver_email, mc_currency, and txn_id uniqueness after receiving a VERIFIED response. Site operators should apply the update through the WordPress plugin dashboard.

Workarounds

Disable the PayPal Standard gateway in WP Hotel Booking settings until the plugin is patched.
Deploy a Web Application Firewall (WAF) rule to block requests containing test_ipn=1 to the booking IPN endpoint.
Restrict IPN endpoint access at the webserver layer to PayPal's published production IP ranges only.

bash

# Example nginx rule to block sandbox IPN abuse
location ~ ^/(\?.*wphb-paypal-standard) {
    if ($arg_test_ipn = "1") {
        return 403;
    }
}