CVE-2026-11868

WP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

We have discovered 856 live websites that are affected by CVE-2026-11868.

Run a Free Instant Scan



Affected Software

Product  Wp Travel
Category Wordpress Plugins
Vulnerable Domains856 live websites (100% of Wp Travel install base)
Vulnerable Versions
  • from 0 through 11.7.1
Vulnerable Versions Count79 versions ( 100% of all versions)


Common Weakness Enumeration

CWE-862 Missing Authorization



Details

  • Published - Jul 20, 2026
  • Updated - Jul 20, 2026

Credits

  • Shivamani Vastrala (finder)
  • WPScan (coordinator)

Website Distribution by Country

Number of websites using CVE-2026-11868
United States241 websites


Vietnam134 websites
Germany67 websites
India45 websites
Italy34 websites
France32 websites
GB29 websites
Romania18 websites
Cyprus15 websites
Indonesia15 websites

Website Distribution by TLD

Number of websites using CVE-2026-11868
.com470 websites
.org40 websites
.net40 websites
.it28 websites
.de21 websites
.co.uk12 websites
.com.br11 websites
.info9 websites
.ru8 websites
.nl7 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-11868

Top websites that are affected by CVE-2026-11868. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
**************.***.au Australia***,***
*********.org United States***,***
*****************.com France*,***,***
***********.com Cyprus*,***,***
************.org United States*,***,***
**************.com Poland*,***,***
******************.com Germany*,***,***
*************.com United States*,***,***
******.it Italy*,***,***
*************.com United States*,***,***
See full domain list

FAQ

CVE-2026-11868 is Missing Authorization in Wp Travel
A total of 856 websites have been identified as vulnerable to CVE-2026-11868, based on global website indexing conducted by WebTechSurvey.
The Wp Travel is affected by the CVE-2026-11868 vulnerability.
Wp Travel versions up to 11.7.1 are vulnerable to CVE-2026-11868.
CVE-2026-11868 is resolved in version 11.7.1 of Wp Travel.