CVE-2026-12393: Unknown WPS Bookings For Woocommerce

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.

Affected products

• Unknown WPS Bookings For Woocommerce: before 3.11.7 (fixed in 3.11.7)

Published 2026-07-17. Last modified 2026-07-17.