Wps Bookings For Woocommerce
Monthly
Broken object-level authorization in the WPS Bookings for WooCommerce WordPress plugin (all versions before 3.11.7) allows any authenticated low-privilege user - including Subscribers and Customers - to cancel booking orders belonging to other customers without ownership verification. This IDOR flaw (CWE-639) enables a malicious registered user to void legitimate bookings across the platform, causing business disruption and financial harm to merchants and their customers. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS at 0.13% (3rd percentile) indicates limited observed exploitation activity at time of analysis.
Broken object-level authorization in the WPS Bookings for WooCommerce WordPress plugin (all versions before 3.11.7) allows any authenticated low-privilege user - including Subscribers and Customers - to cancel booking orders belonging to other customers without ownership verification. This IDOR flaw (CWE-639) enables a malicious registered user to void legitimate bookings across the platform, causing business disruption and financial harm to merchants and their customers. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV, and EPSS at 0.13% (3rd percentile) indicates limited observed exploitation activity at time of analysis.