CVE-2026-11868 WP Travel CVE debrief

Who should care

Users of the WP Travel WordPress plugin before version 11.7.1 should be aware of this vulnerability and take steps to protect their installations. This includes updating to version 11.7.1 or later and restricting access to the booking cancellation action. Monitor for suspicious activity.

Technical summary

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is exposed to unauthenticated users. This allows them to cancel arbitrary bookings on the site. The vulnerability has a medium defensive priority. Users should update to version 11.7.1 or later.

Defensive priority

Medium

Recommended defensive actions

• Update the WP Travel WordPress plugin to version 11.7.1 or later
• Restrict access to the booking cancellation action
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

Evidence is limited; verify with official records and vendor remediation. The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action. This action is exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site. Limited source detail; verify affected scope and vendor guidance.

Official resources