WordPress security by component
WpTravelly
Plugin description
WpTravelly manages tour packages, travel bookings, itineraries, pricing, availability, and customer reservations in WordPress.
WpTravelly (tour-booking-manager) is a WordPress plugin with 9 published CVE records in this archive. The latest tracked vulnerability was published Jun 15, 2026; the highest published CVSS base score is 8.8.
Plugin slug:
tour-booking-managerLatest vulnerability
CVE-2026-27089: WpTravelly: Privilege escalation or authentication bypass
WpTravelly is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 2.1.7.
| Safe version |
|
||
|---|---|---|---|
| Jun 15, 2026 |
CVE-2026-27089
WpTravelly: Privilege escalation or authentication bypass
WpTravelly is affected by privilege escalation or authentication bypass. The vulnerable path is reachable without authentication. A successful request can grant permissions or access that the caller should not possess. The published affected range is n/a through 2.1.7.
|
2.1.8 |
CVE7.5
NVDPending
|
| May 26, 2026 |
CVE-2026-27331
WpTravelly: A security weakness
WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 2.1.5.
|
2.1.6 |
CVE6.3
NVDPending
|
| Apr 08, 2026 |
CVE-2026-39565
WpTravelly: A security weakness
WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is <= 2.1.7.
|
2.1.8 |
CVE4.3
NVDPending
|
| Apr 01, 2025 |
CVE-2025-30892
WpTravelly: Code execution
WpTravelly is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Mar 27, 2025 |
CVE-2025-30891
WpTravelly: Filesystem traversal
WpTravelly is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.8
NVDPending
|
| Jan 15, 2025 |
CVE-2025-22737
WpTravelly: A security weakness
WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Nov 01, 2024 |
CVE-2024-43212
WpTravelly: A security weakness
WpTravelly is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE7.5
NVDPending
|
| May 29, 2024 |
CVE-2024-0434
WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly: Cross-site request forgery
WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.3
NVDPending
|
| Apr 15, 2024 |
CVE-2024-32450
WpTravelly: Cross-site request forgery
WpTravelly is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVDPending
|