What is CVE-2026-12501?
A critical vulnerability in the WP Travel Engine WordPress plugin before version 6.8.2 allows unauthenticated attackers to mark bookings as paid via forged PayPal notifications without verifying the merchant account or payment amount. Sites using affected versions should immediately update the plugin to prevent payment fraud.
Azərbaycanca: WP Travel Engine WordPress plagininin 6.8.2-dən əvvəlki versiyalarında autentifikasiya olunmamış hücumçulara saxta PayPal bildirişləri ilə rezervasiyaları ödənilmiş kimi qeyd etməyə imkan verən kritik zəiflikdir. Təsirə məruz qalan saytlar ödəniş aldatmaları ilə üzləşə bilər, plaginin dərhal son versiyaya yenilənməsi tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-863
FAQ2
Which versions of the WP Travel Engine plugin are affected by CVE-2026-12501?
The vulnerability affects the WP Travel Engine WordPress plugin versions prior to 6.8.2.
What can attackers do by exploiting CVE-2026-12501?
Unauthenticated attackers can mark bookings as paid by sending forged PayPal notifications, leading to potential payment fraud.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.