Home › CVE Intelligence › CVE-2026-12393
CVSS 9.8 CRITICAL Vulnerability

CVE-2026-12393: CVE-2026-12393 - WPS Bookings for WooCommerce < 3.11.7 - Subscriber+ Arbitrary Booking Or…

CVE ID : CVE-2026-12393 Published : July 17, 2026, 6 a.m. | 59minutes ago Description : The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user…

9.8CVSS Score
CRITICALSeverity
NOCISA KEV
VulnerabilityImpact Type

📋 Vulnerability Details

CVE IDCVE-2026-12393
VendorUnknown Vendor
Affected ProductUnknown Product
Vulnerability TypeVulnerability
CVSS Score9.8 (CRITICAL)
Actively Exploited❌ No known exploitation
Patch StatusPending Vendor Disclosure
Reported ByCYBERDUDEBIVASH SENTINEL APEX Intelligence (via sentinel_apex)

🔬 Technical Analysis

CVE ID : CVE-2026-12393

Published : July 17, 2026, 6 a.m. | 59minutes ago

Description : The WPS Bookings for WooCommerce WordPress plugin before 3.11.7 does not verify that a booking order belongs to the requesting user before cancelling it, allowing any authenticated user, such as a Subscriber or Customer, to cancel and void other customers' booking orders.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and mo

🎯 Known Indicators of Compromise

{"type":"indicator","value":"CVE-2026-12393","confidence_score":23.5,"first_seen":"2026-07-17","source_count":1}
⚡ DETECTION RULES AVAILABLE

Get CVE-2026-12393 Detection Pack

Sigma rules, YARA signatures, IOC table, and SIEM queries for Splunk, Elastic, Sentinel, and Chronicle — deployable in 5 minutes.

✓ Sigma Rules ✓ YARA Pack ✓ IOC Table ✓ SIEM Queries
🛡️ Get Detection Pack → 🔌 Access via API →

🔗 Related Intelligence