CVE-2026-111849: WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The vulnerability is rated with network attack vector, low attack complexity, no privileges required, and no user interaction required. This indicates it may be exploitable remotely by an unauthenticated attacker.

Q: Which WpTravelly versions are affected?

WpTravelly versions through 2.3.5 are affected. The available data does not identify a fixed version.

Q: What is the potential impact?

The listed CVSS vector indicates low confidentiality impact, with no integrity or availability impact. The issue is classified as broken access control caused by missing authorization and incorrectly configured access-control levels.

Published Oct 21, 2026

Updated

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.

Affected Software

1 affected component

MagePeople WpTravelly<=2.3.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WpTravelly plugin to a version that resolves this vulnerability.
Fixed in 2.3.6

Event History

Oct 21, 2026

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is rated with network attack vector, low attack complexity, no privileges required, and no user interaction required. This indicates it may be exploitable remotely by an unauthenticated attacker.

Which WpTravelly versions are affected?