CVE-2026-111611 roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to the pay cancel or continue endpoints to close pending orders...

CVE-2026-111611

The roncoo-education platform, through version 25.0.0-RELEASE , is affected by an Insecure Direct Object Reference (IDOR) vulnerability (CWE-639). This flaw exists in the pay cancel and continue endpoints, where the application fails to perform proper ownership validation. Authenticated users can...

CVE-2026-18042: Missing Authorization

The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-message handlers, allowing unauthenticated attackers to cancel the payment on any customer's booking...