CVE-2026-11868
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The WP Travel WordPress plugin before version 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
Risk Assessment
The risk involves an attacker being able to cancel any booking without authorization, potentially causing financial loss, operational disruption, and loss of customer trust.
Recommendation
Immediately update the WP Travel plugin to version 11.7.1 or later, which includes the necessary security fixes.
Other vulnerabilities in WP Travel
See all- CVE-2026-45218High
CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.
- CVE-2026-13145Medium
The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user. Any logged-in user can read another customer's booking details, including billing address information, by supplying an arbitrary booking identifier.
- CVE-2026-13143Medium
The WP Travel WordPress plugin before 11.8.1 does not verify PayPal Instant Payment Notifications through the PayPal post-back handshake before marking a booking paid. Unauthenticated attackers can forge a notification that flips an arbitrary pending booking to a paid and booked state at an attacker-chosen amount.
Original NVD description (English source)
The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.