CVE-2026-11901: thimpress wp_hotel_booking

Vulnerability summary

CVE-2026-11901 is a medium (CVSS 5.3) vulnerability in thimpress wp_hotel_booking. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.5% of scored vulnerabilities.

Timeline

1. 11-07-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

The WP Hotel Booking plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity in all versions up to, and including, 2.3.1. This is due to the `web_hook_process_paypal_standard()` IPN handler selecting its PayPal validation endpoint from the attacker-controlled `$_REQUEST['test_ipn']` parameter, force-upgrading any `pending` transaction to `completed` when `test_ipn=1`, and omitting post-verification checks on `receiver_email`, `mc_currency`, and `txn_id` uniqueness after receiving a `VERIFIED` response from PayPal. This makes it possible for unauthenticated attackers to mark arbitrary hotel bookings as fully paid without submitting genuine payment to the merchant — either by routing IPN validation through PayPal's sandbox using a free sandbox account, or by replaying a previously verified IPN from a nominal payment to an attacker-controlled PayPal account. An attacker requires only a free PayPal sandbox account (or any PayPal account) to obtain a `VERIFIED` response; no site credentials or special configuration are needed.

• CWE-345Insufficient Verification of Data AuthenticityThe product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.