CyberRota Analysis
AI-GeneratedThe WP Travel WordPress plugin prior to version 11.8.1 is vulnerable due to its failure to verify PayPal Instant Payment Notifications, enabling unauthenticated attackers to manipulate booking statuses and amounts. This could lead to unauthorized financial transactions and potential revenue loss for affected sites. WordPress administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.