CVE-2026-120841: WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Q: Does the available information identify a version that fixes the issue?

No. The supplied information identifies affected versions through 2.3.8 but does not name a fixed version.

Published Nov 7, 2026

Updated

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WpTravelly plugin to a version that resolves this vulnerability.
Fixed in 2.3.10

Event History

Nov 7, 2026

CVE Published

via MITRE·12:42 PM

Data Sourced

via MITRE·12:42 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does the available information identify a version that fixes the issue?

No. The supplied information identifies affected versions through 2.3.8 but does not name a fixed version.

CVE-2026-120841: WordPress WpTravelly plugin <= 2.3.8 - Local File Inclusion vulnerability

Remediation

Event History

Frequently Asked Questions

Does the available information identify a version that fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Does the available information identify a version that fixes the issue?