WP Travel Engine Plugin Payment Verification Bypass

Executive Summary

This vulnerability affects the WP Travel Engine WordPress plugin before version 6.8.2. It allows unauthenticated attackers to manipulate payment notifications from PayPal. The plugin fails to verify if a payment notification was sent to the site's configured merchant account or if the paid amount matches the order total. Attackers can exploit this by using a token payment to an attacker-controlled account to mark bookings as fully paid.

Useful 0 Not Useful 0

Detection Guidance

Check if your WP Travel Engine plugin version is below 6.8.2. Inspect PayPal payment notifications for mismatches between paid amounts and order totals. Review booking status logs for unauthorized changes marked as paid without proper verification.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to trick the system into marking fake or unauthorized bookings as paid without actually receiving payment. This could lead to financial losses, unauthorized reservations, or misuse of services. Users relying on this plugin for booking payments may face incorrect booking statuses and potential service disruptions.

Useful 0 Not Useful 0

Mitigation Strategies

Update the WP Travel Engine plugin to version 6.8.2 or later immediately. Verify PayPal payment notifications match configured merchant accounts and order totals before marking bookings as paid. Implement additional validation checks for payment processing.

Useful 0 Not Useful 0