Threats tagged 'ghsa-v4gx-m8c5-cqwv'

WP Travel Engine WordPress plugin versions before 6.8.2 contain a vulnerability where PayPal payment notifications are not properly verified. This allows attackers to mark bookings as paid by sending payment notifications to an attacker-controlled account without authenticating the payment or verifying the amount.