CVE-2026-13146 Overview
CVE-2026-13146 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Travel WordPress plugin versions prior to 12.0.2. The plugin fails to verify that the requester owns the booking targeted by a bank-deposit slip submission. An unauthenticated attacker who knows a target customer's email address can change that customer's booking payment state and attach an arbitrary file to it.
The issue is classified under [CWE-639] (Authorization Bypass Through User-Controlled Key). The plugin trusts client-supplied identifiers without validating ownership against the authenticated session.
Critical Impact
Unauthenticated attackers can tamper with booking payment states and attach files to bookings belonging to any customer whose email address they know.
Affected Products
- WP Travel WordPress plugin versions before 12.0.2
- WordPress sites offering bank-deposit payment flows via WP Travel
- Travel and booking sites relying on WP Travel for payment slip submissions
Discovery Timeline
- 2026-09-09 - CVE-2026-13146 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-13146
Vulnerability Analysis
The vulnerability resides in the bank-deposit slip submission handler exposed by the WP Travel plugin. The handler accepts a booking identifier and a customer email address from the request but does not confirm that the submitter owns the referenced booking. Because the endpoint is reachable without authentication, any remote actor can invoke it against arbitrary bookings.
Successful exploitation lets attackers change the payment state of another customer's booking and attach a file to that booking record. The result is data integrity impact on booking records and potential business logic disruption for site operators who process payments based on the submitted slips.
Exploitation requires knowledge of the target customer's email address, which raises attack complexity. The vulnerability does not disclose data or affect availability directly, but attackers can undermine payment reconciliation workflows and inject attacker-controlled files into booking records.
Root Cause
The root cause is a missing ownership check on the bank-deposit slip submission endpoint. The plugin uses a user-controlled key (the booking reference paired with an email) to locate the booking record but does not cross-validate that the requester is authorized to modify it. This pattern is characteristic of [CWE-639] authorization flaws.
Attack Vector
The attack is delivered over the network against the WordPress site hosting the vulnerable plugin. No authentication or user interaction is required. The attacker crafts an HTTP request to the bank-deposit slip submission endpoint, supplying the victim's email and a target booking, then submits a payment state change and an attached file.
Refer to the WPScan Vulnerability Report for the technical write-up. No verified public exploit code is available at the time of publication.
Detection Methods for CVE-2026-13146
Indicators of Compromise
- Unexpected changes to booking payment state records in the WP Travel database, particularly transitions to a paid or pending-verification state that were not initiated by the customer.
- Uploaded files attached to bookings that do not correspond to legitimate customer submissions, especially files uploaded from unfamiliar IP addresses.
- Repeated POST requests to WP Travel bank-deposit slip submission endpoints referencing multiple different customer emails from the same source IP.
Detection Strategies
- Enable WordPress and web server access logging, then review requests to WP Travel payment and booking endpoints for unauthenticated submissions.
- Correlate booking payment state transitions with authenticated customer sessions; flag transitions with no matching session activity.
- Inspect uploaded files in the WP Travel uploads directory for unexpected content types, executable payloads, or filenames inconsistent with prior customer uploads.
Monitoring Recommendations
- Alert on high-volume POST activity to WP Travel bank-deposit endpoints from single IP addresses or IP ranges.
- Monitor file upload directories used by WP Travel for new files outside normal business hours or from anomalous geographies.
- Track modifications to booking metadata and payment state fields, and route unexplained changes to a security review queue.
How to Mitigate CVE-2026-13146
Immediate Actions Required
- Upgrade the WP Travel plugin to version 12.0.2 or later on all affected WordPress sites.
- Audit recent booking payment state changes and uploaded slip files for the presence of unauthorized modifications since the vulnerable version was installed.
- Notify affected customers if evidence of tampering is found and reconcile payment records against bank statements.
Patch Information
The vendor addressed the vulnerability in WP Travel version 12.0.2 by adding proper ownership verification to the bank-deposit slip submission handler. Site operators should update through the WordPress plugin manager or by deploying the updated plugin package. See the WPScan Vulnerability Report for reference details.
Workarounds
- If immediate patching is not possible, disable the bank-deposit payment method within WP Travel and route customers to alternative payment gateways.
- Restrict access to WP Travel bank-deposit endpoints via a Web Application Firewall (WAF) rule that requires an authenticated WordPress session cookie.
- Rate limit POST requests to WP Travel payment submission URLs to slow enumeration attempts against multiple customer accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.