CVE-2026-12393 is an authorization bypass vulnerability (CWE-639) in the WPS Bookings for WooCommerce WordPress plugin prior to version 3.11.7. The flaw arises because the plugin fails to verify ownership of booking orders before allowing cancellation. As a result, any authenticated user, including those with low-privilege roles such as Subscriber or Customer, can cancel and void booking orders belonging to other users.

This vulnerability allows authenticated users to cancel booking orders that do not belong to them, potentially disrupting business operations and causing denial of service to legitimate customers. It compromises the integrity of booking management by enabling unauthorized cancellation actions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 3.11.7, upgrading to version 3.11.7 or later is likely to address the issue once the vendor releases a fix. Until then, restrict booking cancellation permissions to trusted roles if possible.