WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability
- Exploited
- No known exploitation
- Fix
- Fixed in 2.3.10
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. WpTravelly plugin version 2.3.8 or earlier is affected
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 18/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
The WpTravelly plugin for WordPress, a tour-booking manager, contains a local file inclusion flaw that lets an attacker with a low-privilege account reach it remotely over the network, with no user action needed. Successful exploitation can expose or affect the server's files, with high impact to confidentiality, integrity, and availability.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.
cve.now Index
- Exploitation0/40No signal
- Exposure8/25Specific setups only, reachable over the network
- Reach?/20Unknown. No tracked technology or package matched
- Severity9.8/10CVSS 8.8, total technical impact per CISA
- No patch0/5No signal
What would change the score
- Would score about 68 if added to CISA KEV
- Would score about 63 if CISA's SSVC rates exploitation active
- Would score about 25 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
WpTravelly plugin version 2.3.8 or earlier is affectedUpgrade to a fixed version: 2.3.10.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- tour-booking-manager
through 2.3.8
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120839
Is CVE-2026-120839 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The plugin can be made to load files from the server that it should not load, which can sometimes lead to a full takeover of the site.Source: patchstack.com
Which versions are affected by CVE-2026-120839?
tour-booking-manager: through 2.3.8.Source: cve.now feed data
Am I affected, and how do I check?
WpTravelly plugin version 2.3.8 and earlier, published by Magepeople inc., is affected. To check, look at the plugin version shown on the WordPress Plugins screen.Source: patchstack.com
How do I fix CVE-2026-120839?
Update the WpTravelly plugin to version 2.3.10 or later.Source: patchstack.com