CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site's configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.
Explanation of Vulnerability in Simple Terms
WP Travel Engine versions before 6.8.2 contain an integrity vulnerability accessible over the network without authentication or user interaction. An attacker can modify data or content on the site. The vulnerability has a CVSS score of 5.3 (medium). Update to version 6.8.2 or later to patch this issue.
What an attacker can do
Modify data or content on your site without logging in.
Potential impact on your site
Site content or data could be altered by an unauthenticated attacker.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
