Live › vulnerability › CVE-2026-111849
Go to dashboardWpTravelly is a WordPress tour-booking plugin from Magepeople Inc. A missing authorization check lets a user reach functions they should not, through incorrectly configured access control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WpTravelly plugin at version 2.3.5 or earlier are exposed. Sites without this plugin are not affected. The sources do not say which roles or settings are required to trigger it.
No product ranges from the sources yet.
2.3.5.wp-travelly or tour-booking-manager on the server.2.3.5 once the vendor releases a fix; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-111849")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.