https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T00:41:35.446565+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-365747 EUVD-2026-365747 2026-10-06T00:41:35.498964+00:00 EUVD-2026-365747 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18042 fkie_cve-2026-18042 2026-10-06T00:41:35.499006+00:00

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.

 https://cve.radiocsirt.org/vuln/ghsa-f6xw-m2mf-q3q9 GHSA-f6xw-m2mf-q3q9 2026-10-06T00:41:35.499041+00:00

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking.