CVE-2026-120839: WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Q: Which installations are affected?

WpTravelly installations running version 2.3.8 or earlier are affected. The available data does not identify a specific lower version boundary.

Q: What type of access would an attacker need to exploit this issue?

The provided data identifies a PHP local file inclusion flaw but does not state whether exploitation requires authentication, a particular user role, or any other prerequisite.

Q: Is there a fixed version available?

The provided data confirms the issue affects versions through 2.3.8, but it does not identify a patched version.

Published Nov 7, 2026

Updated

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WpTravelly plugin to a version that resolves this vulnerability.
Fixed in 2.3.10

Event History

Nov 7, 2026

CVE Published

via MITRE·12:43 PM

Data Sourced

via MITRE·12:43 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

WpTravelly installations running version 2.3.8 or earlier are affected. The available data does not identify a specific lower version boundary.

What type of access would an attacker need to exploit this issue?

The provided data identifies a PHP local file inclusion flaw but does not state whether exploitation requires authentication, a particular user role, or any other prerequisite.

Is there a fixed version available?

The provided data confirms the issue affects versions through 2.3.8, but it does not identify a patched version.

CVE-2026-120839: WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What type of access would an attacker need to exploit this issue?

Is there a fixed version available?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What type of access would an attacker need to exploit this issue?

Is there a fixed version available?