CVE-2026-12501

MediumCVSS 5.3/10Last modified Aug 26, 2026

Description

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Vendor	Product	Versions
Unknown	WP Travel Engine	< 6.8.2

References

https://wpscan.com/vulnerability/3959ea5e-9670-4087-9506-44ba95c6a462/

Timeline

Published: Aug 6, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-125028.4Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD thro CVE-2026-125039.2Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 o CVE-2026-125048.4Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD throug CVE-2026-1250406.5A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser CVE-2026-1250415.5A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the CVE-2026-1250456.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine CVE-2026-1250465.3Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control CVE-2026-125057.8A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user in CVE-2026-1250559.8The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up CVE-2026-1250634.3A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard CVE-2026-1250645.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_g CVE-2026-1250655.5FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bit