Travelly CVE-2026-111213

Requires an authenticated WordPress account with Contributor-level capability or above on a site where Travelly ≤2.3.6 is installed and active; no special plugin configuration is needed. The attacker harvests a valid nonce from the Duplicate row-action on their own posts list - the nonce action is the static string 'TTBM_Admin.php' and is not bound to any specific post ID - then replays it against arbitrary victim post IDs. Limiting factors: exploitation is gated by Contributor-or-above authentication (not exploitable by fully unauthenticated attackers), and practical value is highest on multi-author sites holding private/draft/pending posts by Administrators or Editors; single-author sites have little to harvest.

This is a genuine but low-severity authorization flaw (CWE-862), not a high-CVSS/low-real-risk case - the CVSS base of 4.3 already reflects limited impact. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) shows a network-reachable, low-complexity attack requiring low (Contributor-level) privileges and no user interaction, which matches the description precisely: any authenticated Contributor can replay a static, post-independent nonce. Signals are consistent in pointing to modest urgency rather than crisis: KEV status is not set (no confirmed active exploitation), no EPSS score was supplied, and no public exploit code is referenced - only a Wordfence advisory and source-code links. The vuln.today decision label is 'this_month,' not act_now or emergency, which aligns with a disclosure-oriented, privilege-gated bug. One signal conflict must be verified: the NVD vector records C:N / I:L, yet the description's actual harm is unauthorized disclosure of private/draft/pending post content, excerpts, titles, taxonomies and metadata - a confidentiality impact. The I:L rating appears to credit the creation of attacker-owned duplicate drafts rather than the disclosure the text emphasizes; defenders should treat the real-world impact as confidentiality-oriented information disclosure regardless of the I:L label. Net: a real priority for multi-author WordPress sites running this plugin, but a low-severity, authenticated, no-active-exploitation issue overall.

A low-trust Contributor on a multi-author WordPress site running Travelly ≤2.3.6 opens their own Posts list, copies the nonce exposed by the plugin's Duplicate row-action, and replays it against post IDs belonging to Administrators or Editors. The plugin duplicates each targeted private, draft, or pending post into a draft the Contributor owns, revealing its full content, title, excerpt, taxonomies, and metadata. No public exploit code is referenced, but the described technique is self-contained and trivial to reproduce given Contributor access.