CVE-2026-11901 describes an Insufficient Verification of Data Authenticity vulnerability (CWE-345) in the WP Hotel Booking plugin for WordPress. The vulnerability arises in the `web_hook_process_paypal_standard()` IPN handler, which uses the `$_REQUEST['test_ipn']` parameter to select the PayPal validation endpoint. An attacker can set `test_ipn=1` to force the plugin to treat any pending transaction as completed. Additionally, the plugin fails to verify critical fields such as `receiver_email`, `mc_currency`, and the uniqueness of `txn_id` after receiving a VERIFIED response from PayPal. This allows attackers with only a free PayPal sandbox or any PayPal account to mark arbitrary bookings as paid without submitting genuine payments. The vulnerability affects all versions up to and including 2.3.1. No vendor-provided patch or official remediation guidance is available at this time.

An attacker can bypass payment verification and mark hotel bookings as fully paid without making actual payments. This can lead to financial loss for merchants using the WP Hotel Booking plugin, as fraudulent bookings may be accepted and fulfilled without receiving payment. The vulnerability does not impact confidentiality or availability but compromises the integrity of payment processing.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling PayPal IPN processing or implementing additional server-side validation of IPN messages, including verifying `receiver_email`, `mc_currency`, and ensuring `txn_id` uniqueness. Avoid relying on the `test_ipn` parameter for endpoint selection. Monitor vendor channels for updates and apply official patches once released.