CVE-2026-18042

Deferred Deferred - Pending Action

Unauthenticated Booking Payment Cancellation in WP Travel

Publication date: 2026-09-09

Last updated on: 2026-09-09

Assigner: WPScan

Description

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-09

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-18042

EUVD

EUVD-2026-74702

Affected Vendors & Products

Vendor	Product	Version / Range
wp_travel	wp_travel	to 12.0.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is in the WP Travel WordPress plugin before version 12.0.2. It allows unauthenticated attackers to cancel payments on any customer's booking through front-end payment-message handlers because the plugin does not verify if the requester is authorized to act on the targeted booking.

Detection Guidance

Check if your WP Travel plugin version is below 12.0.2 by inspecting the plugin files or WordPress admin panel. Look for unauthorized booking cancellations in server logs or database entries.

Impact Analysis

Unauthenticated attackers could cancel payments on your bookings without your consent, potentially disrupting your travel plans or causing financial inconvenience. This could lead to loss of booked services and require rebooking efforts.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing unauthorized access to customer booking data. Unauthenticated attackers can cancel payments on bookings, which may lead to unauthorized modifications of personal or sensitive information. This could violate data integrity and access control requirements under these regulations.

Mitigation Strategies

Update the WP Travel plugin to version 12.0.2 or later immediately. If updating is not possible, consider disabling the plugin until an update is applied.

Hi! I’m here to help you understand CVE-2026-18042. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70