Skip to content
Sign in
5.3 Medium

CVE-2026-11868 The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking…

Description

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

Affected products and versions

Product Affected versions Fixed in
WP Travel 11.7 earliest → < 11.7.1 11.7.1

Other CVEs of WP Travel

The 6 CVEs of WP Travel →
CVE-2026-18042 The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking… 5.3 Medium CVE-2026-13146 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by… 3.7 Low CVE-2026-13144 The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the… 3.7 Low CVE-2026-13145 The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account… 4.3 Medium
Track this CVE