Description

The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-06T22:16:45.220Z",
  "pubdate": "2026-08-06T22:16:45.220Z",
  "executiveSummary": "The WP Travel Engine WordPress plugin before version 6.8.2 suffers from a critical payment validation flaw related to its PayPal notification handling mechanism. This vulnerability arises because the application fails to verify whether incoming PayPal payment notifications correspond to the site administrator's configured merchant account, and it neglects to validate that the transaction amount matches the original order total. Consequently, unauthenticated remote attackers can manipulate the payment workflow by executing a token payment to an attacker-controlled PayPal account, which then tricks the plugin into marking associated bookings as fully paid. The business impact is severe, allowing malicious actors to fraudulently acquire travel bookings, services, or digital goods without rendering legitimate payment to the merchant. The vulnerability requires network exposure to the vulnerable WordPress installation and relies on the attacker initiating an arbitrary transaction to a malicious endpoint, but it completely bypasses the need for authentication or administrative privileges. Immediate remediation is required to restore financial integrity to the affected e-commerce and booking workflows.",
  "technicalDetails": "The root cause of this vulnerability lies in insufficient input validation and missing server-side verification logic within the payment processing workflow of the WP Travel Engine WordPress plugin. Specifically, when handling asynchronous payment notifications or callbacks from the PayPal gateway, the affected component fails to cryptographically or logically authenticate the transaction parameters against expected values. The application does not check the recipient merchant identifier to confirm that the funds were transferred to the legitimate merchant account controlled by the site owner. Furthermore, the validation routines omit checks comparing the payment amount received in the notification against the corresponding order total stored in the database.\nThe exploitation method relies on an unauthenticated attacker initiating a transaction via PayPal to their own attacker-controlled account, generating a valid payment token or notification payload. Because the vulnerable component accepts this notification without verifying the recipient or the monetary value, the attacker can transmit the crafted notification referencing a target booking identifier on the vulnerable site. The application processes this incoming request, assumes the payment was successfully executed for the legitimate merchant, and updates the booking status in the database to fully paid.\nThe attack flow proceeds as follows: First, the attacker identifies a target booking or order on a WordPress site utilizing WP Travel Engine prior to version 6.8.2. Second, the attacker initiates a nominal or token payment through PayPal directed to a merchant account under their own control. Third, the attacker captures or crafts the corresponding payment notification message. Fourth, the attacker sends this notification to the payment handling endpoint exposed by the WP Travel Engine plugin. Fifth, the vulnerable component processes the notification, blindly trusting the payload without validating the merchant account or cross-referencing the transaction amount with the order total. Finally, the plugin marks the booking as paid, granting the attacker unauthorized access to the booked services.\nThe affected component is the PayPal payment notification handling mechanism within the WP Travel Engine plugin for WordPress, specifically impacting all versions prior to 6.8.2. The vulnerability is exploitable remotely over the network by unauthenticated actors with zero privileges, requiring no prior interaction or compromised credentials."
}