EUVD-2026-45148
GHSA-29vx-66rc-rcvq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network vector and PR:L confirmed by HTTP-based booking API exploitable by any registered user; no confidentiality impact as no data is read or disclosed.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.
AnalysisAI
Broken object-level authorization in the WPS Bookings for WooCommerce WordPress plugin (all versions before 3.11.7) allows any authenticated low-privilege user - including Subscribers and Customers - to cancel booking orders belonging to other customers without ownership verification. This IDOR flaw (CWE-639) enables a malicious registered user to void legitimate bookings across the platform, causing business disruption and financial harm to merchants and their customers. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS at 0.13% (3rd percentile) indicates limited observed exploitation activity at time of analysis.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) describes a classic Insecure Direct Object Reference (IDOR) pattern: the application accepts a user-supplied booking order identifier and acts on it without verifying that the requesting user is the owner of that resource. The affected component is a WordPress plugin that extends WooCommerce with booking management capabilities, identified by CPE cpe:2.3:a:unknown:wps_bookings_for_woocommerce:*:*:*:*:*:*:*:*. In the WordPress permission model, Subscriber and Customer roles are typically assigned automatically upon public registration, meaning any site visitor who creates an account becomes a valid low-privilege authenticated user. The plugin's cancellation endpoint apparently trusts the booking ID parameter without cross-referencing session ownership, making exploitation trivially straightforward for anyone with a valid session token and enumerable order identifiers.
RemediationAI
Update the WPS Bookings for WooCommerce plugin to version 3.11.7 or later, which is the vendor-released patch for this vulnerability. Plugin updates can be applied via the WordPress admin dashboard under Plugins > Installed Plugins, or via WP-CLI. The WPScan advisory at https://wpscan.com/vulnerability/e2088a99-cde1-4c67-91c7-ddb60da11985/ should be consulted for any additional vendor guidance. If immediate patching is not feasible, a compensating control is to disable open user registration on the WordPress site (Settings > General, uncheck 'Anyone can register'), which prevents untrusted users from obtaining authenticated sessions needed to exploit this flaw; note the trade-off is that new legitimate customer signups will also be blocked. Merchants should additionally audit recent booking cancellations in their WooCommerce order history for anomalous patterns that may indicate prior exploitation.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today