{"id":"CVE-2026-120841","kind":"vulnerability","aliases":["CVE-2026-120841"],"related":[],"title":"WpTravelly tour booking plugin: PHP local file inclusion through version 2.3.8","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.","summary":"The WpTravelly tour-booking-manager WordPress plugin by Magepeople fails to control filenames passed to PHP include or require statements. An attacker can make the site load and run a local PHP file of their choosing.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","tour-booking-manager","wordpress","wptravelly"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the WpTravelly (tour-booking-manager) plugin is installed on the WordPress site and note its version.\n- Confirm the installed version is above `2.3.8` in the plugin's version listing.","fix":"- WpTravelly (tour-booking-manager): a fixed version is unknown; the sources only say affected versions run through `2.3.8`.","status":"open","published_at":"2026-11-07T13:16:35+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:12+00:00","updated_at":"2026-11-07T13:49:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-07T13:49:12Z","model":"claude-haiku-5-5","output":{"fix":"- WpTravelly (tour-booking-manager): a fixed version is unknown; the sources only say affected versions run through `2.3.8`.","reach":"internet","title":"WpTravelly tour booking plugin: PHP local file inclusion through version 2.3.8","impact":"high","summary":"The WpTravelly tour-booking-manager WordPress plugin by Magepeople fails to control filenames passed to PHP include or require statements. An attacker can make the site load and run a local PHP file of their choosing.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wptravelly","tour-booking-manager","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs local PHP files on the web server","analyst_note":"Find the vendor advisory or a patched plugin version and confirm whether the flaw needs authentication; the NVD entry gives no fixed version.","how_to_check":"- Check whether the WpTravelly (tour-booking-manager) plugin is installed on the WordPress site and note its version.\n- Confirm the installed version is above `2.3.8` in the plugin's version listing.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WpTravelly tour-booking-manager WordPress plugin at version 2.3.8 or earlier are in the affected range according to the source. The sources do not describe the exact code path or required configuration, so it is unknown whether an unauthenticated visitor can trigger it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000718,"input_tokens":4232,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120841':14A,17A '-2026':13A,16A '2.3.8':11A,97C 'affect':92C 'allow':86C 'attack':48B 'book':3A,22B,30B,84C 'choos':62B 'control':38B,64C 'cve':12A,15A 'fail':36B 'file':7A,59B,75C,89C 'filenam':39B,66C 'improp':63C 'inc':80C 'includ':43B 'include/require':68C 'inclus':8A,76C 'inclusion.this':90C 'issu':91C 'load':53B 'local':6A,57B,88C 'magepeopl':35B,79C 'make':50B 'manag':23B,31B,85C 'n/a':95C 'packag':18B 'pass':40B 'php':5A,19B,42B,58B,71C,73C,87C 'plugin':4A,33B 'program':72C 'remot':74C 'requir':45B 'run':55B 'site':52B 'statement':46B,69C 'tour':2A,21B,29B,83C 'tour-booking-manag':20B,28B,82C 'version':10A 'vulner':77C 'wordpress':24B,32B 'wptravelli':1A,25B,27B,81C,93C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WpTravelly tour-booking-manager WordPress plugin at version 2.3.8 or earlier are in the affected range according to the source. The sources do not describe the exact code path or required configuration, so it is unknown whether an unauthenticated visitor can trigger it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","tourbookingmanager","wordpress","wptravelly"],"campaign_type":null,"search_a":"'-120841':14A,17A '-2026':13A,16A '2.3.8':11A 'book':3A 'cve':12A,15A 'file':7A 'inclus':8A 'local':6A 'php':5A 'plugin':4A 'tour':2A 'version':10A 'wptravelli':1A","search_b":"'attack':48B 'book':22B,30B 'choos':62B 'control':38B 'fail':36B 'file':59B 'filenam':39B 'includ':43B 'load':53B 'local':57B 'magepeopl':35B 'make':50B 'manag':23B,31B 'packag':18B 'pass':40B 'php':19B,42B,58B 'plugin':33B 'requir':45B 'run':55B 'site':52B 'statement':46B 'tour':21B,29B 'tour-booking-manag':20B,28B 'wordpress':24B,32B 'wptravelli':25B,27B","search_c":"'2.3.8':97C 'affect':92C 'allow':86C 'book':84C 'control':64C 'file':75C,89C 'filenam':66C 'improp':63C 'inc':80C 'include/require':68C 'inclus':76C 'inclusion.this':90C 'issu':91C 'local':88C 'magepeopl':79C 'manag':85C 'n/a':95C 'php':71C,73C,87C 'program':72C 'remot':74C 'statement':69C 'tour':83C 'tour-booking-manag':82C 'vulner':77C 'wptravelli':81C,93C","first_public_at":"2026-11-07T13:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120841","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120841","severity":null,"published_at":"2026-11-07T13:16:35+00:00","modified_at":"2026-11-07T13:16:35+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}