WpTravelly CVE-2026-27089

Target WordPress site must have the MagePeople WpTravelly (Tour Booking Manager) plugin installed and active at version 2.1.7 or earlier, with the affected plugin endpoint reachable over HTTP/HTTPS from the attacker. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, no user interaction, and no non-default configuration are required - exploitation works against default installs. Limiting factors are narrow: the attack only impacts integrity (C:N/A:N), so it does not directly yield data exfiltration or denial of service, and sites that have removed or disabled the plugin, or that gate /wp-admin and plugin AJAX/REST endpoints behind IP allowlists or a WAF rule covering this CVE, are not exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (7.5 High) indicates network-reachable, low-complexity, fully unauthenticated exploitation with high integrity impact but no confidentiality or availability loss - consistent with an action-level auth bypass that lets attackers modify or create records but not directly dump data or crash the service. EPSS data was not supplied in the input, so quantitative probability of exploitation cannot be cited. The vulnerability is not listed in CISA KEV and no public PoC is referenced by Patchstack at this time, so exploitation pressure is currently lower than the CVSS suggests; however, WordPress plugin auth bypasses are historically rapidly weaponized once a Patchstack advisory is public, so the real-world risk should be treated as elevated for any internet-exposed install.

An attacker discovers a WordPress site running WpTravelly ≤ 2.1.7 via plugin fingerprinting, then sends a crafted HTTP request to an affected plugin endpoint that omits or forges authentication tokens. The server accepts the request as if from a privileged user and the attacker manipulates bookings, tour data, or other integrity-sensitive records without ever logging in. No public PoC is referenced in the supplied data, but the AC:L/PR:N/UI:N vector indicates exploitation is straightforward once the vulnerable endpoint is identified.