CVE-2026-11868: WP Travel Auth Bypass Vulnerability

CVE-2026-11868 Overview

CVE-2026-11868 affects the WP Travel WordPress plugin in versions prior to 11.7.1. The plugin fails to perform capability or ownership checks on its booking cancellation action. The vulnerable endpoint is also exposed to unauthenticated users. As a result, any remote attacker can cancel arbitrary bookings on affected sites without credentials or user interaction.

The issue is categorized under [CWE-862] Missing Authorization. It affects the integrity of booking data managed by the plugin but does not expose confidential information or crash the site.

Critical Impact
Unauthenticated attackers can cancel arbitrary customer bookings on WordPress sites running WP Travel before version 11.7.1, disrupting travel operations and revenue.

Affected Products

WP Travel WordPress plugin versions prior to 11.7.1
WordPress sites with the WP Travel plugin activated
Travel and booking websites relying on WP Travel for reservation management

Discovery Timeline

2026-07-20 - CVE-2026-11868 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-11868

Vulnerability Analysis

The WP Travel plugin exposes a booking cancellation action that lacks proper access control. The action does not verify whether the requester holds the required WordPress capability. It also does not confirm that the requester owns the booking being cancelled. Because the endpoint is reachable without authentication, any visitor can invoke it against any booking identifier.

This is a business logic flaw combined with a missing authorization defect. The plugin trusts the client-supplied booking reference and processes the cancellation directly. Attackers can enumerate booking identifiers and cancel them in bulk. The consequence is loss of reservation integrity, customer service disruption, and potential revenue loss for travel operators.

Root Cause

The root cause is the absence of current_user_can() checks and ownership validation within the booking cancellation handler. The action is also registered on hooks accessible to unauthenticated users, such as wp_ajax_nopriv_* or a public REST route. Without capability enforcement or nonce validation tied to a specific user session, the handler processes any incoming cancellation request as legitimate.

Attack Vector

The attack is delivered over the network with no authentication and no user interaction. An attacker sends a crafted HTTP request to the vulnerable cancellation endpoint. The request includes a booking identifier that the attacker either knows or discovers through enumeration. The server processes the cancellation and updates the booking status. See the WPScan Vulnerability Details for endpoint specifics.

Detection Methods for CVE-2026-11868

Indicators of Compromise

Unexpected changes in booking status to cancelled without corresponding customer-initiated requests.
HTTP POST or GET requests to WP Travel cancellation endpoints originating from unauthenticated sessions or unfamiliar IP addresses.
Sequential or enumerated booking identifiers appearing in web server access logs within short time windows.

Detection Strategies

Review WordPress database audit logs for bulk booking_status transitions to a cancelled state.
Correlate web server access logs with WP Travel admin logs to identify cancellations without matching authenticated sessions.
Deploy a Web Application Firewall (WAF) rule to flag requests to WP Travel action parameters that lack a valid nonce.

Monitoring Recommendations

Enable verbose logging on the WordPress admin-ajax.php and REST API endpoints used by WP Travel.
Alert on high request rates targeting the plugin's cancellation action from any single client.
Monitor customer support channels for reports of unexpected booking cancellations that may indicate active exploitation.

How to Mitigate CVE-2026-11868

Immediate Actions Required

Update WP Travel to version 11.7.1 or later on all WordPress sites where the plugin is installed.
Audit booking records for cancellations that occurred before the patch was applied and restore any that were unauthorized.
Restrict access to WordPress AJAX and REST endpoints at the WAF or reverse proxy layer while patching is in progress.

Patch Information

The vendor addressed the vulnerability in WP Travel version 11.7.1 by adding capability and ownership checks to the booking cancellation handler. Refer to the WPScan Vulnerability Details for the fixed release information.

Workarounds

Temporarily deactivate the WP Travel plugin if immediate patching is not possible and bookings can be managed through alternate means.
Implement WAF rules that block unauthenticated requests to the WP Travel cancellation action parameter.
Restrict access to the WordPress site by IP allowlist or authentication proxy until the plugin can be updated.

bash

# Example WAF rule blocking unauthenticated cancellation attempts
SecRule REQUEST_URI "@contains admin-ajax.php" \
    "chain,deny,status:403,id:1026118680,\
    msg:'Block WP Travel unauthenticated booking cancellation'"
    SecRule ARGS:action "@rx wp_travel.*cancel" \
        "chain"
        SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"