CVE-2026-13143: WP Travel Auth Bypass Vulnerability

CVE-2026-13143 Overview

CVE-2026-13143 affects the WP Travel WordPress plugin in versions prior to 11.8.1. The plugin fails to verify PayPal Instant Payment Notifications (IPN) through the PayPal post-back handshake before marking a booking as paid. Unauthenticated attackers can forge an IPN request that flips any pending booking to a paid and booked state at an attacker-chosen amount. The flaw represents a business logic error rooted in missing authentication of a trusted external service callback.

Critical Impact
Unauthenticated attackers can forge PayPal payment confirmations, converting arbitrary pending bookings into confirmed paid bookings without transferring any funds.

Affected Products

WP Travel WordPress plugin versions before 11.8.1
WordPress sites accepting PayPal payments through WP Travel
Travel booking installations relying on WP Travel IPN processing

Discovery Timeline

2026-07-30 - CVE-2026-13143 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-13143

Vulnerability Analysis

The WP Travel plugin exposes a PayPal IPN listener endpoint that processes payment confirmation callbacks. PayPal's IPN protocol requires the receiving application to post the received notification back to PayPal, which responds with VERIFIED or INVALID. This handshake authenticates the message as originating from PayPal. WP Travel omits this post-back verification and instead trusts the raw HTTP request payload. An attacker can send a crafted POST request that mimics a PayPal IPN, including a booking identifier and payment amount, and the plugin will update the booking record to a paid state. The vulnerability enables theft of goods and services offered through the booking flow without financial settlement.

Root Cause

The root cause is missing origin authentication of external service callbacks, a business logic flaw in the IPN handler. The plugin should validate every IPN by re-posting the message to PayPal and requiring a VERIFIED response before updating booking state. Without this step, no cryptographic or transactional evidence ties the callback to PayPal.

Attack Vector

Exploitation requires only network access to the WordPress site. The attacker crafts an HTTP POST request to the WP Travel IPN endpoint containing forged PayPal IPN fields such as payment_status=Completed, a target invoice or custom identifier referencing a pending booking, and an mc_gross value chosen by the attacker. The plugin accepts the request without contacting PayPal and marks the booking paid. No authentication, user interaction, or prior session is required.

See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-13143

Indicators of Compromise

POST requests to WP Travel PayPal IPN endpoints originating from IP addresses outside PayPal's published IPN sender ranges
Booking status transitions from pending to paid without a corresponding PayPal transaction ID in merchant records
IPN records lacking a matching verification response log entry from ipnpb.paypal.com

Detection Strategies

Reconcile WP Travel booking payment records against the PayPal merchant transaction history on a scheduled basis
Log all inbound requests to the WP Travel IPN handler and alert on requests without a subsequent outbound post-back to PayPal
Deploy web application firewall rules to inspect IPN callback requests and flag anomalous field values or source addresses

Monitoring Recommendations

Monitor WordPress access logs for POST requests targeting WP Travel IPN routes
Track booking state changes and correlate them with authenticated PayPal API activity
Alert on any booking marked paid with an mc_gross value inconsistent with the listed trip price

How to Mitigate CVE-2026-13143

Immediate Actions Required

Update the WP Travel plugin to version 11.8.1 or later
Audit all bookings marked paid since deployment for matching PayPal transaction records
Refund or void any bookings that lack a verified PayPal settlement

Patch Information

The vendor addressed the issue in WP Travel version 11.8.1 by implementing the PayPal post-back handshake before updating booking state. Site administrators should upgrade through the WordPress plugin manager or by replacing plugin files with the patched release. Reference the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily disable PayPal as a payment method in WP Travel until patching is complete
Restrict access to the IPN endpoint at the web server or WAF layer to PayPal's published IPN source ranges
Manually verify each PayPal booking against the merchant portal before fulfilling the reservation

bash

# Example nginx restriction limiting IPN endpoint access to PayPal networks
location ~* /wp-travel.*ipn {
    allow 173.0.80.0/20;
    allow 64.4.240.0/21;
    deny all;
}