CVE-2026-12501

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.2

Description The plugin fails to verify if incoming PayPal payment notifications were sent to the configured merchant account or if the paid amount matches the order total before marking a booking as paid. This allows unauthenticated attackers to mark bookings as fully paid by using a token payment directed to an account controlled by the attacker.

Recommendations Update WP Travel Engine to version 6.8.2 or later.