CVE-2026-12501— WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Travel Engine | < 6.8.2 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-12501
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver and Amount Verification
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Travel Engine | 0 ~ 6.8.2 | - |
II. Public POCs for CVE-2026-12501
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12501
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12501 (1)
Same Patch Batch · Unknown · 2026-08-06 · 49 CVEs total
| CVE-2026-11976 | 10.0 CRITICAL | MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise |
| CVE-2026-14812 | 10.0 CRITICAL | Premium SEO - Unauthenticated Backdoor (Admin Creation / RCE / SSRF / Content Injection) |
| CVE-2026-17032 | 9.8 CRITICAL | Supsystic Multiple Pro Plugins - Backdoor via Compromised Vendor Update Server |
| CVE-2026-3430 | 8.6 HIGH | Creative Mail 1.6.5 - 1.6.9 - Unauthenticated SQLi |
| CVE-2026-10599 | 7.5 HIGH | Integrate PhonePe with WooCommerce <= 1.2.1 - Unauthenticated Payment Bypass via Transacti |
| CVE-2026-12584 | 7.5 HIGH | Payment Gateway for Redsys & WooCommerce Lite < 7.0.2 - Unauthenticated Payment Confirmati |
| CVE-2026-13399 | 7.5 HIGH | Payment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse |
| CVE-2026-10524 | 7.5 HIGH | CoCart < 4.9.0 - Unauthenticated Arbitrary Price Manipulation |
| CVE-2026-16619 | 7.5 HIGH | miniOrange 2FA < 6.2.8 - 2FA Bypass via Unlimited Second-Factor Attempts |
| CVE-2026-16620 | 7.5 HIGH | WPC Name Your Price for WooCommerce < 2.2.5 - Unauthenticated Price Manipulation via Selec |
| CVE-2026-5336 | 6.8 MEDIUM | Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Infor |
| CVE-2026-11361 | 5.9 MEDIUM | Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Sub |
| CVE-2026-12901 | 5.9 MEDIUM | GetPaid < 2.8.55 - Unauthenticated Worldpay Payment Bypass via Insufficient IPN Verificati |
| CVE-2026-15147 | 5.3 MEDIUM | Five Star Restaurant Reservations < 2.7.23 - Unauthenticated Payment Bypass and Booking Co |
| CVE-2026-16067 | 5.3 MEDIUM | Event Booking Manager for WooCommerce (Pro) < 5.0.3 - Unauthenticated Payment Bypass via C |
| CVE-2026-13342 | 5.3 MEDIUM | Security Optimizer – The All-In-One Protection Plugin < 1.6.5 - Login Access IP Allowlist |
| CVE-2026-15149 | 5.3 MEDIUM | WP Hotel Booking < 2.3.3 - Unauthenticated Payment Bypass via Price Manipulation |
| CVE-2026-14936 | 5.3 MEDIUM | Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver |
| CVE-2026-15152 | 5.3 MEDIUM | WP Hotel Booking < 2.3.2 - Unauthenticated PayPal Payment Bypass |
| CVE-2026-14831 | 5.3 MEDIUM | Easy Booking < 3.5.0 - Unauthenticated Minimum Booking Duration Bypass |
Showing top 20 of 49 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Travel Engine
- CVE-2026-12500
WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty L - CVE-2026-10834
WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File - CVE-2026-49770
WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Inj - CVE-2026-49078
WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerab - CVE-2025-59574
WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scri
Same vendor: Unknown
- CVE-2026-19075
All-in-One Video Gallery < 4.9.2 - Subscriber+ Server-Side R - CVE-2026-19074
Advanced Classifieds & Directory Pro < 3.4.3 - Unauthenticat - CVE-2026-19089
Product Input Fields for WooCommerce < 2.0.2 - Unauthenticat - CVE-2026-19077
Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post D - CVE-2026-15047
s2Member < 260805 - Contributor+ Stored XSS via Shortcode
V. Comments for CVE-2026-12501
No comments yet