Skip to content
OpenAdvisories
High · 8.8 CVE-2026-120839 EUVD-2026-119250GHSA-ph8f-6vfc-x44v

WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Published Nov 7, 2026 · Updated Nov 7, 2026 · Assigned by Patchstack

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Affected products

VendorProductAffectedFixed
Magepeople WpTravelly ≤ 2.3.8 —

References