# WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 12.0.4 - Unauthenticated Coupon Usage Restriction Bypass

- **ID:** WPSEC-2026-1891
- **Plugin:** WP Travel – Ultimate Travel Booking System, Tour Management Engine (`wp-travel`), https://wordpress.org/plugins/wp-travel/
- **Affected versions:** all versions before 12.1.0
- **Fixed in:** 12.1.0 (Update to 12.1.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-840
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-29)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-travel
- **Fix released:** 2026-10-28
- **Published:** 2026-10-29
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1891/

## Description

The WP Travel plugin for WordPress is vulnerable to a coupon usage restriction bypass via the checkout process in all versions up to, and including, 12.0.4. Coupon validity and the usage limit are checked only when the coupon is applied to the cart, and the usage count is raised without locking only when the booking is processed. This makes it possible for unauthenticated attackers to complete bookings with a discount after the coupon has expired or been disabled, or to use a limited coupon more times than allowed by applying it in several carts before any checkout or by checking out at the same time.

## References

- https://wpsec.com/vuln/WPSEC-2026-1891/
- https://plugins.svn.wordpress.org/wp-travel/tags/12.1.0/
- https://wordpress.org/plugins/wp-travel/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1891/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.