https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 07:54:16 +0000 https://cve.radiocsirt.org/vuln/cve-2026-12501 <p><strong>Affected:</strong> Unknown WP Travel Engine</p> <p>The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site&#39;s configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.</p> <p><strong>Affected:</strong> Unknown WP Travel Engine</p> <p>The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent to the site&#39;s configured merchant account, nor that the paid amount matches the order total, before marking a booking as paid, allowing unauthenticated attackers to mark bookings as fully paid using a token payment made to an attacker-controlled account.</p> https://cve.radiocsirt.org/vuln/cve-2026-12501