What is GHSA-mvh6-8vcr-6fw5?

GHSA-mvh6-8vcr-6fw5 is a security advisory published by GitHub Security Advisories with Medium severity. The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on...

Which CVE IDs does GHSA-mvh6-8vcr-6fw5 cover?

GHSA-mvh6-8vcr-6fw5 covers the following CVE IDs: CVE-2026-11868. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mvh6-8vcr-6fw5?

GHSA-mvh6-8vcr-6fw5 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-mvh6-8vcr-6fw5MediumCVSS 5.3

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-11868 →

📋 Description

The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unauthenticated users, allowing them to cancel arbitrary bookings on the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-11868
https://wpscan.com/vulnerability/a82da13b-ee86-495b-a684-324c1541d7ab
https://github.com/advisories/GHSA-mvh6-8vcr-6fw5