CVE-2026-11901 is an Insufficient Verification of Data Authenticity vulnerability (CWE-345) in the WP Hotel Booking plugin for WordPress versions up to and including 2.3.1. The vulnerability arises from the `web_hook_process_paypal_standard()` IPN handler using the attacker-controlled `$_REQUEST['test_ipn']` parameter to select the PayPal validation endpoint, allowing an attacker to force-upgrade any pending transaction to completed by setting `test_ipn=1`. Additionally, the plugin omits critical post-verification checks on `receiver_email`, `mc_currency`, and the uniqueness of `txn_id` after receiving a VERIFIED response from PayPal. This flaw enables unauthenticated attackers to mark arbitrary hotel bookings as fully paid without submitting genuine payments, either by routing IPN validation through PayPal's sandbox or by replaying previously verified IPNs from nominal payments to attacker-controlled accounts. No special site credentials or configurations are required for exploitation.

An attacker can fraudulently mark hotel bookings as paid without making any real payment, potentially leading to financial loss for the merchant. The integrity of payment verification is compromised, allowing unauthorized transaction status changes. There is no impact on confidentiality or availability reported, but the integrity impact is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling PayPal IPN processing or implementing additional manual verification of payment details. Monitoring for suspicious booking status changes may help detect exploitation attempts. Avoid relying on the `test_ipn` parameter for validation endpoint selection and ensure all payment details are verified after receiving PayPal's VERIFIED response.