CVE-2026-11868
WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 20, 2026
- Updated
- Jul 20, 2026
- Reserved
- Jun 10, 2026
Description
The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
WP TravelUnknown |
|
References
- https://wpscan.com/vulnerability/a82da13b-ee86-495b-a684-324c1541d7ab/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.