Yatra <= 3.0.17 - Unauthenticated Payment Bypass via 'payment_gateway' Parameter
- ID
- WPSEC-2026-2272
- Plugin
- Yatra – Travel Booking & Tour Operator Software (yatra)
- Affected
- all versions before 3.1.0
- Remediation
- Update to 3.1.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-20
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Yatra on WPSec AttackSurface
- Fix released
- Published
Description
The Yatra plugin for WordPress is vulnerable to a payment bypass via the 'payment_gateway' parameter of the booking checkout REST endpoint in all versions up to, and including, 3.0.17. This is due to insufficient validation of the submitted payment gateway against the gateways the site owner has enabled. A missing gateway defaulted to the offline 'pay_later' gateway, and an explicitly submitted 'pay_later' value was accepted even when that gateway was disabled. This makes it possible for unauthenticated attackers to create pay-on-arrival bookings that hold seats and trigger a booking confirmation email without paying, even on sites that only offer online payment. With the default settings these bookings are automatically marked as confirmed.
References
- https://wpsec.com/vuln/WPSEC-2026-2272/
- https://plugins.svn.wordpress.org/yatra/tags/3.1.0/
- https://wordpress.org/plugins/yatra/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS