Description
The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the `web_hook_process_paypal_standard()` IPN handler selecting its PayPal validation endpoint from the attacker-controlled `$_REQUEST['test_ipn']` parameter, force-upgrading any `pending` transaction to `completed` when `test_ipn=1`, and omitting post-verification checks on `receiver_email`, `mc_currency`, and `txn_id` uniqueness after receiving a `VERIFIED` response from PayPal. This makes it possible for unauthenticated attackers to mark arbitrary hotel bookings as fully paid without submitting genuine payment to the merchant — either by routing IPN validation through PayPal's sandbox using a free sandbox account, or by replaying a previously verified IPN from a nominal payment to an attacker-controlled PayPal account. An attacker requires only a free PayPal sandbox account (or any PayPal account) to obtain a `VERIFIED` response; no site credentials or special configuration are needed.
Published: 2026-07-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WP Hotel Booking plugin of PayPal instant payment notifications in all versions through 2.3.1 fails to validate the source of the IPN correctly, allows the attacker‑controlled request parameter to select the verification endpoint, and ignores critical checks on receiver email, currency, and transaction ID uniqueness after PayPal returns a VERIFIED status. This flaw enables unauthenticated attackers to make a hotel booking appear paid without submitting real payment, either by using a PayPal sandbox account to receive a VERIFIED response from an attacker’s own PayPal account, or by replaying a previously verified IPN from a nominal payment to an attacker-controlled PayPal account.

Affected Systems

The affected product is thimpress WP Hotel Booking, a WordPress plugin, in all releases up to and including version 2.3.1. Any WordPress site running these versions of the plugin is vulnerable.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.3, indicating moderate severity, and an EPSS score of <1%, indicating a low probability of exploitation at present. It is not listed in the CISA KEV catalog. Exploitation requires only that the site run an unpatched instance of the plugin; no site credentials or special configuration are needed. The most likely vector is the external PayPal IPN system sending notifications to the site, which an attacker can influence through a sandbox or replayed message.

Generated by OpenCVE AI on July 29, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WP Hotel Booking to a version with a fixed IPN handler (preferably the latest release from ThimPress).
  • If an upgrade cannot be performed immediately, modify the plugin’s PayPal IPN processing code to always use PayPal’s production verification URL, reject any request with `test_ipn=1`, and enforce checks on `receiver_email`, `mc_currency`, and the uniqueness of `txn_id` after receiving a VERIFIED response.
  • Disable or tightly restrict the use of PayPal sandbox test mode for a live production site, and consider implementing an additional verification step that cross‑checks the transaction details against the active booking record.

Generated by OpenCVE AI on July 29, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 11 Jul 2026 08:30:00 +0000

Type Values Removed Values Added
First Time appeared Thimpress
Thimpress wp Hotel Booking
Wordpress
Wordpress wordpress
Vendors & Products Thimpress
Thimpress wp Hotel Booking
Wordpress
Wordpress wordpress

Sat, 11 Jul 2026 06:30:00 +0000

Type Values Removed Values Added
Description The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the `web_hook_process_paypal_standard()` IPN handler selecting its PayPal validation endpoint from the attacker-controlled `$_REQUEST['test_ipn']` parameter, force-upgrading any `pending` transaction to `completed` when `test_ipn=1`, and omitting post-verification checks on `receiver_email`, `mc_currency`, and `txn_id` uniqueness after receiving a `VERIFIED` response from PayPal. This makes it possible for unauthenticated attackers to mark arbitrary hotel bookings as fully paid without submitting genuine payment to the merchant — either by routing IPN validation through PayPal's sandbox using a free sandbox account, or by replaying a previously verified IPN from a nominal payment to an attacker-controlled PayPal account. An attacker requires only a free PayPal sandbox account (or any PayPal account) to obtain a `VERIFIED` response; no site credentials or special configuration are needed.
Title WP Hotel Booking <= 2.3.1 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via PayPal IPN Handler
Weaknesses CWE-345
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

Thimpress Wp Hotel Booking
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-07-14T14:26:01.248Z

Reserved: 2026-06-10T15:44:24.822Z

Link: CVE-2026-11901

cve-icon Vulnrichment

Updated: 2026-07-14T14:25:56.593Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T09:30:18Z

Weaknesses
  • CWE-345

    Insufficient Verification of Data Authenticity