{"id":"CVE-2026-120839","kind":"vulnerability","aliases":["CVE-2026-120839"],"related":[],"title":"WpTravelly WordPress plugin: file inclusion flaw lets attackers read or run local PHP files","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.","summary":"The WpTravelly tour-booking WordPress plugin builds a file path for PHP include/require from input an attacker can influence, so it loads files it should not. An attacker can read or execute local PHP files on the site, with the impact of an NVD CVSS 8.8 rating.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","tour-booking-manager","wordpress","wptravelly"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WpTravelly (tour-booking-manager) plugin is installed and its version, in the WordPress admin under Plugins, or with `wp plugin get tour-booking-manager --field=version` if WP-CLI is available.\n- Compare the installed version against the affected range: all versions through `2.3.8`.","fix":"- WpTravelly (tour-booking-manager): the sources give no fixed version; the affected range is through `2.3.8`.","status":"open","published_at":"2026-11-07T13:16:34+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:12+00:00","updated_at":"2026-11-07T13:49:12+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:12Z","model":"claude-haiku-5-5","output":{"fix":"- WpTravelly (tour-booking-manager): the sources give no fixed version; the affected range is through `2.3.8`.","reach":"internet","title":"WpTravelly WordPress plugin: file inclusion flaw lets attackers read or run local PHP files","impact":"high","summary":"The WpTravelly tour-booking WordPress plugin builds a file path for PHP include/require from input an attacker can influence, so it loads files it should not. An attacker can read or execute local PHP files on the site, with the impact of an NVD CVSS 8.8 rating.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wptravelly","tour-booking-manager","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker reads or executes local PHP files on the web server","analyst_note":"Confirm the fixed version and the vulnerable parameter from the Magepeople advisory or the WordPress plugin page; the NVD entry gives only the affected range.","how_to_check":"- Check whether the WpTravelly (tour-booking-manager) plugin is installed and its version, in the WordPress admin under Plugins, or with `wp plugin get tour-booking-manager --field=version` if WP-CLI is available.\n- Compare the installed version against the affected range: all versions through `2.3.8`.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WpTravelly tour-booking-manager WordPress plugin at version 2.3.8 or earlier are in the affected range. Sites without this plugin, or with a later version confirmed by the vendor, can skip it. The sources do not say which request paths or settings make the include reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4232,"output_tokens":654,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120839':17A,20A '-2026':16A,19A '2.3.8':111C '8.8':75B 'affect':106C 'allow':100C 'attack':8A,46B,57B 'book':25B,33B,98C 'build':36B 'control':78C 'cve':15A,18A 'cvss':74B 'execut':61B 'file':4A,14A,38B,52B,64B,89C,103C 'filenam':80C 'flaw':6A 'impact':70B 'improp':77C 'inc':94C 'include/require':42B,82C 'inclus':5A,90C 'inclusion.this':104C 'influenc':48B 'input':44B 'issu':105C 'let':7A 'load':51B 'local':12A,62B,102C 'magepeopl':93C 'manag':26B,99C 'n/a':109C 'nvd':73B 'packag':21B 'path':39B 'php':13A,22B,41B,63B,85C,87C,101C 'plugin':3A,35B 'program':86C 'rate':76B 'read':9A,59B 'remot':88C 'run':11A 'site':67B 'statement':83C 'tour':24B,32B,97C 'tour-book':31B 'tour-booking-manag':23B,96C 'vulner':91C 'wordpress':2A,27B,34B 'wptravelli':1A,28B,30B,95C,107C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WpTravelly tour-booking-manager WordPress plugin at version 2.3.8 or earlier are in the affected range. Sites without this plugin, or with a later version confirmed by the vendor, can skip it. The sources do not say which request paths or settings make the include reachable.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","tourbookingmanager","wordpress","wptravelly"],"campaign_type":null,"search_a":"'-120839':17A,20A '-2026':16A,19A 'attack':8A 'cve':15A,18A 'file':4A,14A 'flaw':6A 'inclus':5A 'let':7A 'local':12A 'php':13A 'plugin':3A 'read':9A 'run':11A 'wordpress':2A 'wptravelli':1A","search_b":"'8.8':75B 'attack':46B,57B 'book':25B,33B 'build':36B 'cvss':74B 'execut':61B 'file':38B,52B,64B 'impact':70B 'include/require':42B 'influenc':48B 'input':44B 'load':51B 'local':62B 'manag':26B 'nvd':73B 'packag':21B 'path':39B 'php':22B,41B,63B 'plugin':35B 'rate':76B 'read':59B 'site':67B 'tour':24B,32B 'tour-book':31B 'tour-booking-manag':23B 'wordpress':27B,34B 'wptravelli':28B,30B","search_c":"'2.3.8':111C 'affect':106C 'allow':100C 'book':98C 'control':78C 'file':89C,103C 'filenam':80C 'improp':77C 'inc':94C 'include/require':82C 'inclus':90C 'inclusion.this':104C 'issu':105C 'local':102C 'magepeopl':93C 'manag':99C 'n/a':109C 'php':85C,87C,101C 'program':86C 'remot':88C 'statement':83C 'tour':97C 'tour-booking-manag':96C 'vulner':91C 'wptravelli':95C,107C","first_public_at":"2026-11-07T13:16:34+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120839","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120839","severity":null,"published_at":"2026-11-07T13:16:34+00:00","modified_at":"2026-11-07T13:16:35+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}