The WP Travel WordPress plugin versions prior to 11.8.1 do not properly verify PayPal IPNs via the PayPal post-back handshake before updating booking statuses. This lack of verification enables unauthenticated attackers to forge IPN messages, thereby changing the status of any pending booking to paid and booked, potentially with arbitrary payment amounts. The vulnerability is classified as CWE-290 (Authentication Bypass by Spoofing). No official patch or remediation level has been confirmed in the provided data.

An attacker can bypass authentication controls on payment verification, causing the system to accept fraudulent payment notifications. This results in arbitrary pending bookings being marked as paid and confirmed without actual payment, leading to potential financial loss or booking fraud. The confidentiality and availability of the system are not impacted, but integrity is compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling PayPal IPN payment processing or implementing additional manual verification steps for booking payments to prevent unauthorized booking confirmations.