What is GHSA-29vx-66rc-rcvq?

GHSA-29vx-66rc-rcvq is a security advisory published by GitHub Security Advisories with Medium severity. The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking...

Which CVE IDs does GHSA-29vx-66rc-rcvq cover?

GHSA-29vx-66rc-rcvq covers the following CVE IDs: CVE-2026-12393. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-29vx-66rc-rcvq?

GHSA-29vx-66rc-rcvq has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-29vx-66rc-rcvqMediumCVSS 5.4

The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking...

Vendor

GitHub Security Advisories

Published

July 17, 2026

Last Modified

July 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-12393 →

📋 Description

The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-12393
https://wpscan.com/vulnerability/e2088a99-cde1-4c67-91c7-ddb60da11985
https://github.com/advisories/GHSA-29vx-66rc-rcvq