# Yatra <= 3.0.17 - Unauthenticated Payment Bypass via 'payment_gateway' Parameter

- **ID:** WPSEC-2026-2272
- **Plugin:** Yatra – Travel Booking & Tour Operator Software (`yatra`), https://wordpress.org/plugins/yatra/
- **Affected versions:** all versions before 3.1.0
- **Fixed in:** 3.1.0 (Update to 3.1.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-20
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/yatra
- **Fix released:** 2026-11-01
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2272/

## Description

The Yatra plugin for WordPress is vulnerable to a payment bypass via the 'payment_gateway' parameter of the booking checkout REST endpoint in all versions up to, and including, 3.0.17. This is due to insufficient validation of the submitted payment gateway against the gateways the site owner has enabled. A missing gateway defaulted to the offline 'pay_later' gateway, and an explicitly submitted 'pay_later' value was accepted even when that gateway was disabled. This makes it possible for unauthenticated attackers to create pay-on-arrival bookings that hold seats and trigger a booking confirmation email without paying, even on sites that only offer online payment. With the default settings these bookings are automatically marked as confirmed.

## References

- https://wpsec.com/vuln/WPSEC-2026-2272/
- https://plugins.svn.wordpress.org/yatra/tags/3.1.0/
- https://wordpress.org/plugins/yatra/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2272/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.