CVE-2026-11868

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.30% chance of exploitation in the next 30 days, 23th percentile

Published

2026-07-20

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/a82da13b-ee86-495b-a684-324c1541d7ab/

References

• CVE Record
• NVD entry

Related

• CVE-2026-11867
• CVE-2026-11869
• CVE-2026-11866
• CVE-2026-11870
• CVE-2026-11855
• CVE-2026-11872