CVE-2026-11868

mediumCVSS 5.3covered by 1 sourcefirst seen 2026-07-20

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

⚡ Watch CVE-2026-11868

Get an email if CVE-2026-11868 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-11868: The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks o…nvd · 2026-07-20

External references

NVD record for CVE-2026-11868

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-11868 status](https://www.csirts.com/badge/CVE-2026-11868)](https://www.csirts.com/cve/CVE-2026-11868)