What is CVE-2026-11868?

CVE-2026-11868 is a medium-severity vulnerability in Wp Travel, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-07-20.

How severe is CVE-2026-11868?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Auth bypass in Wp Travel

CVE-2026-11868

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

Vulnerability class: Broken Access Control

EPSS: 0.001 (3.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Unknown Wp Travel — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-11868?: CVE-2026-11868 is a medium-severity vulnerability in Wp Travel, classified under Missing Authorization. CVSS score: 5.3/10. Published 2026-07-20.
How severe is CVE-2026-11868?: Medium severity. CVSS v3 base score is 5.3 out of 10.