CVE-2026-18042: WP Travel WordPress Auth Bypass Vulnerability

CVE-2026-18042 Overview

CVE-2026-18042 affects the WP Travel WordPress plugin in versions prior to 12.0.2. The plugin fails to verify that a requester is authorized to act on the booking targeted by one of its front-end payment-message handlers. Unauthenticated attackers can cancel the payment on any customer's booking by invoking the vulnerable handler with a target booking identifier. The flaw is categorized as Missing Authorization [CWE-862] and is exploitable over the network without user interaction.

Critical Impact
Unauthenticated attackers can cancel payments on arbitrary customer bookings, disrupting travel operator revenue collection and booking integrity.

Affected Products

WP Travel WordPress plugin versions before 12.0.2
WordPress sites running WP Travel with front-end booking and payment workflows enabled
Travel and tour operator websites relying on WP Travel for reservation management

Discovery Timeline

2026-09-09 - CVE-2026-18042 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-18042

Vulnerability Analysis

The WP Travel plugin exposes front-end AJAX handlers that process payment-related messages associated with a booking. One of these handlers accepts a booking identifier and mutates the booking's payment state without validating whether the requester owns or is permitted to modify that booking. Because the endpoint is reachable by unauthenticated users, any visitor can submit a crafted request referencing another customer's booking ID and cancel the associated payment.

The integrity impact is limited to the payment-status field of the targeted booking. Confidentiality and availability are not directly affected, but downstream business processes tied to payment state such as confirmation emails, refund logic, and inventory allocation can be disrupted.

Root Cause

The root cause is a Missing Authorization defect [CWE-862]. The vulnerable front-end payment-message handler performs its state-changing action based solely on parameters supplied in the request. It does not compare the current user or session against the owner of the referenced booking. Nonce checks, if present, do not substitute for per-object authorization because the endpoint is intended to be reachable from unauthenticated payment flows.

Attack Vector

An attacker only needs to know or enumerate a valid booking identifier. Identifiers in WordPress plugins are frequently sequential integers, which makes enumeration trivial. The attacker sends an HTTP request to the plugin's front-end payment-message handler, supplies the target booking ID, and the server executes the cancellation on behalf of the victim. No authentication, elevated privilege, or user interaction is required.

No verified proof-of-concept code has been published. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-18042

Indicators of Compromise

Unexpected booking payment cancellations reported by customers who did not initiate the change
Bursts of anonymous POST requests to WP Travel front-end AJAX endpoints referencing enumerated booking IDs
Payment state transitions in the WP Travel database that do not correlate with authenticated user sessions or payment-gateway callbacks

Detection Strategies

Inspect web server access logs for repeated admin-ajax.php or WP Travel REST calls carrying booking identifier parameters from unauthenticated sources
Correlate booking payment-status changes with the originating session cookie and IP address to identify actions taken outside the booking owner's session
Deploy WordPress activity logging to record all state changes on WP Travel booking objects, including the acting user or lack thereof

Monitoring Recommendations

Alert on high-rate iteration through numeric booking IDs from a single client, which indicates enumeration
Monitor customer support channels for a spike in payment cancellation complaints
Track the ratio of payment cancellations to legitimate refund gateway events; a divergence suggests abuse of the vulnerable handler

How to Mitigate CVE-2026-18042

Immediate Actions Required

Upgrade the WP Travel plugin to version 12.0.2 or later on every WordPress site where it is installed
Audit booking payment-status history since installation to identify unauthorized cancellations and restore affected records
Notify affected customers if unauthorized payment cancellations are discovered during the audit

Patch Information

The vendor has resolved the issue in WP Travel version 12.0.2. The fix introduces authorization checks in the front-end payment-message handler so that only the booking owner or an authorized operator can modify payment state. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to WP Travel front-end AJAX endpoints via a Web Application Firewall rule until the plugin is upgraded
Disable the WP Travel plugin on sites where immediate upgrade is not feasible and booking cancellation abuse is a business risk
Enforce rate limiting on admin-ajax.php and WP Travel REST routes to slow booking ID enumeration

bash

# Example WAF rule concept: block unauthenticated POSTs to WP Travel payment-message action
# Adjust the action name to match the vulnerable handler identified in the advisory
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1026180420,msg:'Block WP Travel payment-message handler pending patch'"
  SecRule ARGS:action "@rx ^wp_travel_.*payment.*message$" \
    "chain"
    SecRule &REQUEST_COOKIES:wordpress_logged_in_ "@eq 0"