Cross-user booking cancellation via missing ownership check

Authorization bypass in WP Swings Bookings for WooCommerce before 3.11.7 allows remote authenticated users to cancel other customers' orders. The bfw_cancelled_booked_order AJAX action accepts attacker-supplied order_id and product_id values without confirming that the order belongs to the requester, then zeroes its booking line item and marks it cancelled. Subscriber or Customer access, an enabled self-service cancellation setting, and a cancellable order status are required; successful requests void another customer's booking order.