CVE-2026-11868
Deferred Deferred - Pending Action

Unauthenticated Booking Cancellation in WP Travel Plugin

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: WPScan

Description
The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-11868
EUVD
EUVD-2026-45880

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_travel wp_travel to 11.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the WP Travel WordPress plugin versions before 11.7.1. It allows unauthenticated users to cancel any booking on a site by exploiting missing checks in the cancellation action. Attackers can use a public nonce from any page to send cancellation requests without verifying identity or ownership.

Detection Guidance

Check if your WP Travel plugin version is below 11.7.1 by inspecting the plugin files or WordPress admin panel. Look for unauthorized booking cancellations in server logs or database entries.

Impact Analysis

Unauthenticated users can cancel arbitrary bookings, leading to financial losses, disrupted services, or reputational damage. Businesses using the plugin may face customer dissatisfaction and potential revenue loss.

Compliance Impact

This vulnerability could violate GDPR by exposing personal booking data to unauthorized cancellations or HIPAA if health-related bookings are affected. Compliance may be compromised due to unauthorized data access or service disruption.

Mitigation Strategies

Update the WP Travel plugin to version 11.7.1 or later immediately. If updating is not possible, consider disabling the plugin temporarily until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11868. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart