The WP Travel WordPress plugin before version 11.8.1 allows attackers to forge PayPal Instant Payment Notifications without authenticating the request. By sending a crafted IPN, an attacker can change a pending booking to a paid state with an arbitrary amount. This is an authentication bypass that enables unauthorized transactions and could lead to financial loss and reputational damage.

Affected systems include the WP Travel WordPress plugin across all releases older than 11.8.1. Site owners who run the plugin on WordPress sites without updating are at risk. No specific vendor name is listed, but the plugin is widely available on WordPress plugin repositories.

The CVSS score of 5.3 indicates moderate severity while the EPSS score of <1% suggests a low likelihood of exploitation in the current threat landscape. The vulnerability is not listed in the CISA KEV catalog. The vulnerability requires no authentication but does hinge on the ability to call the plugin’s IPN endpoint, typically exposed via a public URL. Because an attacker can specify arbitrary booking amounts, the potential impact on revenue and customer trust is significant, although the overall exploitation probability remains low.