CVE-2026-62063: WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The published severity vector indicates that an attacker needs low-level privileges (PR:L). The attack can be performed over the network, requires no user interaction, and has low attack complexity.

Q: What is the potential impact?

Successful exploitation can affect integrity and availability at a low level. No confidentiality impact is identified in the supplied severity vector.

Q: Which WpTravelly versions are affected?

WpTravelly versions through 2.3.1 are affected. The available data does not identify a fixed version.

Published Oct 1, 2026

Updated

Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.

Affected Software

1 affected component

MagePeople WpTravelly<=2.3.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress WpTravelly plugin to a version that resolves this vulnerability.
Fixed in 2.3.2

Event History

Oct 1, 2026

CVE Published

via MITRE·12:38 PM

Data Sourced

via MITRE·12:38 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The published severity vector indicates that an attacker needs low-level privileges (PR:L). The attack can be performed over the network, requires no user interaction, and has low attack complexity.

What is the potential impact?