CVE-2026-13144: WP Travel WordPress Auth Bypass Vulnerability

CVE-2026-13144 Overview

CVE-2026-13144 is a broken access control vulnerability [CWE-284] in the WP Travel WordPress plugin versions before 12.0.2. The bank-deposit handler contains a branch that fails to verify whether the requester is authorized to modify the targeted booking. An unauthenticated attacker who knows the target customer's email address can reset that customer's booking payment status to unpaid and wipe stored deposit-reconciliation data.

Critical Impact
Unauthenticated attackers can tamper with booking payment state and destroy bank-deposit reconciliation data by supplying only the victim's email address.

Affected Products

WP Travel WordPress plugin versions prior to 12.0.2
WordPress sites offering bank-deposit payment through WP Travel
Travel and booking sites relying on WP Travel deposit reconciliation records

Discovery Timeline

2026-09-09 - CVE-2026-13144 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-13144

Vulnerability Analysis

The WP Travel plugin exposes a handler for processing bank-deposit payment interactions. One code branch inside this handler processes requests that reference a booking through customer-identifying information rather than an authenticated session.

The handler does not confirm that the caller owns or is authorized to modify the referenced booking. An attacker who supplies the correct customer email can trigger state changes on that customer's booking without authentication. The request resets the payment status to unpaid and removes the stored bank-deposit reconciliation data associated with that booking.

The attack requires knowledge of a valid customer email address, which raises attack complexity but does not require credentials, tokens, or user interaction. The impact is limited to integrity of booking and reconciliation records; confidentiality and availability of the wider system are not directly affected.

Root Cause

The root cause is missing authorization enforcement in one branch of the bank-deposit handler. The branch trusts client-supplied identifiers such as the customer email address as a sufficient authorization signal. It does not check nonces, capabilities, or session ownership before mutating booking payment status and deposit-reconciliation fields, which is the pattern classified under [CWE-284] Improper Access Control.

Attack Vector

Exploitation is performed over the network by issuing a crafted HTTP request to the vulnerable WP Travel endpoint. The attacker supplies the target customer's email address in the request parameters. The server executes the bank-deposit branch, marks the booking as unpaid, and clears stored deposit-reconciliation data. No authentication, credential theft, or victim interaction is required. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-13144

Indicators of Compromise

Unexpected transitions of WP Travel booking payment status from paid to unpaid without an accompanying refund or admin action.
Bank-deposit reconciliation fields for existing bookings that are unexpectedly empty or reset.
Access log entries showing anonymous POST requests to WP Travel bank-deposit endpoints referencing customer email addresses.

Detection Strategies

Monitor web server access logs for unauthenticated requests hitting WP Travel payment or bank-deposit handler URLs.
Alert on database changes to WP Travel booking payment status fields that originate from sessions without an authenticated user context.
Correlate booking status changes with source IP and user agent to identify automated tampering attempts.

Monitoring Recommendations

Enable WordPress audit logging for all booking and order metadata mutations tied to the WP Travel plugin.
Track requests to plugin AJAX and REST endpoints, and baseline expected volume for the bank-deposit handler.
Forward web, application, and database telemetry to a centralized analytics platform for correlation and retention.

How to Mitigate CVE-2026-13144

Immediate Actions Required

Upgrade the WP Travel plugin to version 12.0.2 or later on every WordPress installation.
Audit recent bookings for unexpected transitions to an unpaid state and restore reconciliation data from backups where required.
Restrict public exposure of admin-ajax and REST endpoints via a web application firewall until patching is complete.

Patch Information

Upgrade WP Travel to version 12.0.2 or later. The vendor advisory referenced by the WPScan Vulnerability Report documents the fixed release, which adds authorization checks in the bank-deposit handler branch.

Workarounds

Temporarily disable the WP Travel plugin on production sites that cannot immediately install version 12.0.2.
Block unauthenticated POST requests to WP Travel bank-deposit handler endpoints at the WAF or reverse proxy tier.
Rotate or mask customer email addresses in public-facing content to raise the difficulty of guessing valid targets.

bash

# Example WAF rule pattern to block unauthenticated bank-deposit requests
# (adapt path and parameter names to your deployment)
SecRule REQUEST_URI "@contains wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1013144,msg:'Block anon WP Travel bank-deposit handler'"
  SecRule ARGS:action "@rx ^wp_travel_.*(bank|deposit).*$" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"