CVE-2026-13143
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake be
CVSS
5.3
Medio
EPSS
0.2%
p13
KEV
—
Exploit Today
4
0-100
Publicado: 30 jul 2026 · Última mod.: 30 jul 2026 · CWE-290
0.1%EPSS · 30 días0.2%
2026-07-302026-08-05
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid, allowing unauthenticated attackers to forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-646658.1 ALT—
———Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, without knowing that user's password, because the application matched OAuth identities to accounts by email address alone. Exploitation requires OAuth to be explicitly enabled with such a provider. This issue is fixed in versions 5.74.1 and 6.24.0.2hCVE-2026-655708.1 ALT—
———Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.2hCVE-2026-655025.3 MED—
———Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons <= 8.7.13 versions.2hCVE-2026-324695.3 MED—
———Unauthenticated Bypass Vulnerability in CAPTCHA 4WP <= 7.6.0 versions.8hCVE-2026-48063—5.3%
——2Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12.2dCVE-2026-148405.3 MED4.2%
——1The YOP Poll WordPress plugin before 7.0.6 does not validate the connection's origin IP address and instead trusts client-controlled forwarding headers when enforcing its per-IP vote restriction, allowing unauthenticated attackers to bypass the vote limit and cast unlimited votes on a public poll.1d