WpTravelly CVE-2026-27331

Exploitation requires the attacker to hold a valid authenticated session on the target WordPress site at any low-privilege level (PR:L per CVSS vector), such as a subscriber or contributor role. The WpTravelly plugin (version 2.1.5 or earlier) must be installed and active. No special non-default configuration is required beyond the plugin being present - the access control flaw exists in the plugin's default state. Exploitation is limited by the authentication barrier: unauthenticated attackers cannot exploit this vulnerability. Sites with closed user registration or where all accounts are trusted face materially lower risk. No specific feature flag or protocol mode is identified as a prerequisite beyond plugin activation.

The CVSS 6.3 Medium score reflects a network-exploitable (AV:N), low-complexity (AC:L) vulnerability requiring only low privileges (PR:L) with no user interaction (UI:N), producing limited but real confidentiality, integrity, and availability impact (C:L/I:L/A:L) with unchanged scope (S:U). However, the EPSS score of 0.03% at the 10th percentile strongly signals this vulnerability is not being actively targeted or widely exploited in the wild. There is no CISA KEV listing and no public exploit code identified. The realistic risk is therefore moderate-to-low for most organizations: any authenticated WordPress user (e.g., a registered subscriber) could potentially exploit this, which matters most in multi-tenant WordPress environments or sites with open user registration. Sites with closed registration or where all users are trusted significantly reduce the practical threat surface. No CVSS/description conflict detected - both consistently indicate a low-privilege authenticated network attacker scenario.

An attacker registers or obtains a low-privilege account (e.g., a subscriber) on a WordPress site running WpTravelly 2.1.5 or earlier. The attacker then calls a plugin-specific AJAX action or REST endpoint that lacks proper capability verification, enabling them to read, modify, or disrupt travel booking records beyond their authorized scope. No public exploit code has been identified at time of analysis, so exploitation would currently require manual discovery of the unprotected endpoint.