{
 "id": "WPSEC-2026-2272",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2272/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2272/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2272/index.md",
 "title": "Yatra <= 3.0.17 - Unauthenticated Payment Bypass via 'payment_gateway' Parameter",
 "description": "The Yatra plugin for WordPress is vulnerable to a payment bypass via the 'payment_gateway' parameter of the booking checkout REST endpoint in all versions up to, and including, 3.0.17. This is due to insufficient validation of the submitted payment gateway against the gateways the site owner has enabled. A missing gateway defaulted to the offline 'pay_later' gateway, and an explicitly submitted 'pay_later' value was accepted even when that gateway was disabled. This makes it possible for unauthenticated attackers to create pay-on-arrival bookings that hold seats and trigger a booking confirmation email without paying, even on sites that only offer online payment. With the default settings these bookings are automatically marked as confirmed.",
 "plugin": {
  "slug": "yatra",
  "name": "Yatra",
  "full_name": "Yatra – Travel Booking & Tour Operator Software",
  "wordpress_org": "https://wordpress.org/plugins/yatra/",
  "advisories_url": "https://wpsec.com/vuln/plugin/yatra/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/yatra"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-20"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.1.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.1.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.1.0",
 "remediation": "Update to 3.1.0 or later.",
 "fix_released": "2026-11-01T02:54:30+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:22:40.984930+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2272/",
  "https://plugins.svn.wordpress.org/yatra/tags/3.1.0/",
  "https://wordpress.org/plugins/yatra/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/yatra",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}