CVE-2026-12501 describes an insufficient verification of data authenticity (CWE-345) in the WP Travel Engine plugin for WordPress. The plugin fails to verify that incoming PayPal payment notifications correspond to the site's configured merchant account and that the payment amount matches the order total before marking a booking as paid. This flaw enables unauthenticated attackers to mark bookings as fully paid by submitting payment notifications linked to attacker-controlled accounts.

An attacker can manipulate booking payment status without making a legitimate payment to the merchant account, potentially leading to unauthorized access to services or goods without payment. The vulnerability impacts the integrity of the booking payment process but does not affect confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Users should monitor vendor communications for updates and consider additional verification controls for payment notifications in the meantime.