EUVD-2026-45880
GHSA-mvh6-8vcr-6fw5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network endpoint, no complexity or interaction; only integrity impact (booking records cancelled), no confidentiality or system availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.
AnalysisAI
Missing authorization on the booking cancellation endpoint in the WP Travel WordPress plugin (all versions before 11.7.1) permits any unauthenticated internet visitor to cancel arbitrary bookings on affected sites. The action is exposed without capability checks or ownership verification, meaning no login or elevated role is required. A public proof-of-concept is available via WPScan; no confirmed active exploitation in CISA KEV at time of analysis, though the trivial attack complexity makes opportunistic abuse realistic.
Technical ContextAI
WP Travel is a WordPress plugin for travel agencies and booking management. The vulnerability is classified as CWE-862 (Missing Authorization): the plugin's booking cancellation action - exposed as a WordPress AJAX or REST endpoint - performs no call to current_user_can() or equivalent capability check, and does not verify that the requesting user owns or has rights over the targeted booking. WordPress plugin security requires that state-mutating actions gate on both nonce verification and capability checks; this endpoint omits both for unauthenticated contexts. CPE cpe:2.3:a:unknown:wp_travel:*:*:*:*:*:*:*:* covers all releases from 0 through 11.7.0 inclusive, per EUVD-2026-45880.
RemediationAI
The primary fix is to upgrade the WP Travel plugin to version 11.7.1 or later, which introduces proper capability and ownership verification on the booking cancellation action; this update can be applied from the WordPress admin dashboard under Plugins → Updates or via WP-CLI with wp plugin update wp-travel. If an immediate upgrade is not feasible, a targeted compensating control is to block unauthenticated POST requests to the relevant AJAX action (e.g., the wp-admin/admin-ajax.php handler or the specific REST route) using WAF rules or server-level ACLs - note this may affect other plugin functionality and should be validated in a staging environment before deployment. Disabling the booking cancellation feature through plugin settings, if the option exists, is an additional interim measure. Full advisory details are at https://wpscan.com/vulnerability/a82da13b-ee86-495b-a684-324c1541d7ab/.
Unauthenticated booking fraud is possible in the WP Travel WordPress plugin before 11.8.1 due to missing PayPal Instant
Unauthenticated payment cancellation in WP Travel WordPress plugin before 12.0.2 allows any remote actor to cancel a pay
Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remot
Insecure Direct Object Reference in the WP Travel WordPress plugin (all versions before 11.8.1) exposes customer booking
The WP Travel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.4.6.
WP Travel plugin versions before 12.0.2 for WordPress exposes an Insecure Direct Object Reference (IDOR) flaw in the ban
Improper access control in the WP Travel WordPress plugin before 12.0.2 exposes booking payment records to unauthenticat
Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to ext
Broken authentication in the WP Travel WordPress plugin (versions ≤ 12.0.3) exposes protected plugin functionality to un
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today