PT-2026-61523 · WordPress · Wp Travel

Shivamani Vastrala · CVE-2026-11868 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Travel WordPress plugin versions prior to 11.7.1

Description An issue exists where the booking cancellation action does not perform capability or ownership checks. This action is exposed to unauthenticated users, enabling them to cancel arbitrary bookings on the site.

Recommendations Update WP Travel WordPress plugin to version 11.7.1 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-11868

Affected Products

Wp Travel

References · 3

• 🔥 https://wpscan.com/vulnerability/a82da13b-ee86-495b-a684-324c1541d7ab · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-11868 · Security Note
• https://twitter.com/VulmonFeeds/status/2079143229027410314 · Twitter Post