Vulnerabilities / WP Travel – Ultimate Travel Booking System, Tour Management Engine / WPSEC-2026-1891
WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Unauthenticated Coupon Usage Restriction Bypass
Medium 5.3
CWE-840Fixed in 12.1.0
- ID
- WPSEC-2026-1891
- Plugin
- WP Travel – Ultimate Travel Booking System, Tour Management Engine (wp-travel)
- Affected
- all versions before 12.1.0
- Remediation
- Update to 12.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-840
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-29
- Attack surface
- WP Travel – Ultimate Travel Booking System, Tour Management Engine on WPSec AttackSurface
- Fix released
- Published
Description
The WP Travel plugin for WordPress is vulnerable to a coupon usage restriction bypass via the checkout process in all versions up to, and including, 12.0.4. Coupon validity and the usage limit are checked only when the coupon is applied to the cart, and the usage count is raised without locking only when the booking is processed. This makes it possible for unauthenticated attackers to complete bookings with a discount after the coupon has expired or been disabled, or to use a limited coupon more times than allowed by applying it in several carts before any checkout or by checking out at the same time.
References
- https://wpsec.com/vuln/WPSEC-2026-1891/
- https://plugins.svn.wordpress.org/wp-travel/tags/12.1.0/
- https://wordpress.org/plugins/wp-travel/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS