The vulnerability is an IDOR that allows any authenticated user, such as a Subscriber or Customer, to cancel and void booking orders belonging to other users by submitting a booking identifier to the plugin's cancellation endpoint. The plugin fails to verify that the booking order belongs to the requesting user before executing the cancellation, which constitutes an Improper Access Control flaw (CWE-639). This flaw permits an attacker to remove valid bookings, thereby disrupting service availability for affected customers.

WordPress sites that have the WPS Bookings for WooCommerce plugin installed at a version earlier than 3.11.7 are affected. Any user with a Subscriber or Customer role who can authenticate against the site can exploit this flaw. This vulnerability is not present in the plugin after version 3.11.7 where the ownership check has been added.

CVSS 5.4 indicates a moderate risk, and EPSS <1% suggests practical exploitation is unlikely at the moment. The flaw is not listed in CISA KEV. An attacker must be authenticated to reach the vulnerable endpoint, and there is currently no publicly available exploit code, so the threat remains limited to sites hosting vulnerable plugin versions and exposing the cancellation operation to standard user roles. Based on the description, it is inferred that the cancellation endpoint is accessible to authenticated users and requires a booking identifier; no ownership validation occurs before cancellation.