What’s Vulnerable › Products

WP Travel vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your WP Travel version is affected

Latest WP Travel vulnerabilities

• CVE-2026-18042 — WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation (CVSS 5.3)
• CVE-2026-13146 — WP Travel < 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR (CVSS 3.7)
• CVE-2026-13144 — WP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset (CVSS 3.7)
• CVE-2026-13145 — WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR (CVSS 4.3)
• CVE-2026-13143 — WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN (CVSS 5.3)
• CVE-2026-11868 — WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation (CVSS 5.3)