Quick answers
- Is CVE-2026-11868 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-11868 being exploited in the wild.
- How severe is CVE-2026-11868?
- Informational severity, with a CVSS score of 5.3, published 20 July 2026.
- Which products and versions are affected?
- WP Travel < 11.7.1.
- Is there a fix for CVE-2026-11868?
- A patch was published on 2026-07-20: Fixed in version 11.7.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-11868 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-11868?
- Check whether you run WP Travel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The WP Travel plugin fails to implement proper authorization checks (CWE-862) within its AJAX handler for booking cancellations. Specifically, the 'wp_travel_cancel_booking' action does not verify if the user requesting the cancellation is the owner of the booking or an administrator. While the action requires a security nonce, this nonce is often exposed on public-facing pages, making it accessible to unauthenticated attackers. By sending a crafted POST request to the admin-ajax.php endpoint with a valid nonce and a target 'booking_id', an attacker can change the status of any booking to 'canceled'. This vulnerability was addressed in version 11.7.1.
Affected products
- WP Travel WP Travel < 11.7.1
Timeline
- 2026-06-29: disclosed: Vulnerability details published by WPScan
- 2026-07-20: advisory: CVE-2026-11868 published to NVD
- 2026-07-20: patched: Fixed in version 11.7.1