CVE-2026-11868

The WP Travel plugin for WordPress versions prior to 11.7.1 is vulnerable due to a lack of capability and ownership checks on its booking cancellation action, which is accessible to unauthenticated users. This flaw allows attackers to cancel any booking on affected sites, potentially disrupting services and leading to financial losses. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.