EUVD-2026-90806
GHSA-g5x7-h7v7-hjvx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged WordPress user
-
DeliveryIdentify unprotected WpTravelly action/endpoint
-
ExploitSend request bypassing access-control check
-
ExecutionModify restricted booking data or state
-
ImpactLimited integrity and availability impact
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account on the target WordPress site (CVSS PR:L) running the Magepeople WpTravelly / tour-booking-manager plugin at version 2.3.1 or earlier; exploitation leverages the plugin's incorrectly configured access-control security levels, meaning a low-privilege user can reach actions that should be restricted to higher roles. Limiting factors: a valid logged-in session is mandatory (no unauthenticated path), impact is confined to limited integrity and availability with no confidentiality exposure, and no user interaction is needed (UI:N). No special non-default configuration is called out beyond having the vulnerable plugin version installed and active. |
| Impact | This is a moderate-severity, authenticated broken-access-control flaw with a modest real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, 5.4) indicates a remotely reachable, low-complexity issue that nonetheless REQUIRES an existing authenticated account (PR:L), which materially limits mass exploitation. Impact is bounded: no confidentiality loss (C:N), only limited integrity (I:L) and availability (A:L) - consistent with CWE-862 missing authorization allowing a low-privileged user to perform actions or state changes gated to higher roles. No EPSS score, no CISA KEV listing, and no public POC were provided, so this is not a demonstrated or widespread-exploitation candidate; it reads as a routine Patchstack-catalogued WordPress plugin authorization gap rather than an urgent threat. One data caveat: the input Tag 'Authentication Bypass' conflicts with the assigned CWE-862 (missing authorization) and the description (which describes exploiting misconfigured access-control levels by an already-authenticated user) - this is an authorization flaw, not authentication bypass; the CVSS PR:L confirms authentication is required, so treat the tag as mislabeled. |
| Exploit ScenarioDerived | An attacker who holds a low-privilege account on a WordPress site running WpTravelly ≤2.3.1 (e.g., a subscriber or customer registered through the booking workflow) invokes a plugin action or endpoint that lacks a proper capability/ownership check. Because access-control levels are incorrectly enforced, the attacker modifies booking/tour data or state they should not be able to touch (I:L) and can disrupt limited functionality (A:L). No public exploit code was identified at time of analysis, and exploitation presupposes a valid authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Authenticated broken access control in the Magepeople WpTravelly (tour-booking-manager) WordPress plugin, affecting versions through 2.3.1, allows any logged-in low-privilege user to invoke plugin functionality that should be restricted to higher-privileged roles, weakening site integrity and availability. The assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L confirms a valid authenticated session is mandatory (PR:L, unauthenticated attackers are excluded), no user interaction is needed, and there is no confidentiality impact. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), so this presents as a moderate-priority, authenticated authorization gap whose real-world weight rises on sites that permit open registration or host many subscriber-level accounts.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied intelligence contains no fixed version beyond the affected 2.3.1 ceiling, so treat any currently published 2.3.1-or-earlier build as unfixed and watch the Patchstack advisory and the Magepeople plugin changelog for a corrected release before upgrading. In the interim, the highest-value compensating control is to deactivate or uninstall the WpTravelly plugin on sites where tour booking is not actively in use - this fully removes the attack surface with the obvious trade-off of losing the booking functionality. If the plugin must stay live, harden the account layer it depends on: disable public user registration, audit existing subscribers and other low-privilege roles with a capability-scanning plugin, and remove or downgrade accounts that do not need to log in, since the flaw is only reachable with a valid session and raising the barrier to obtaining one is the most direct mitigation. A virtual patching layer or WAF rule can be configured to block non-privileged requests to the plugin's administrative AJAX/REST endpoints, but such rules are signature-dependent and may break legitimate front-end booking flows, so they should be validated in a staging environment first. Finally, monitor plugin-side content and booking records for unexpected modification, and confirm the plugin's admin-facing pages are not exposed to subscriber-level roles.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a third-party WordPress plugin - Magepeople's WpTravelly / tour-booking-manager - registered in the CPE dictionary as cpe:2.3:a:magepeople_inc.:wptravelly:*:*:*:*:*:*:*:*. The root-cause class is CWE-862 Missing Authorization: the plugin's access-control configuration is incorrect, so registered handlers (typically admin-ajax actions, REST routes, or form POST handlers used for tour and booking management) fail to perform the capability checks that WordPress exposes through current_user_can() and related role/capability APIs before executing privileged operations. In the WordPress ecosystem this class is commonly paired with a missing or weakly enforced nonce check, which would normally stop cross-site or role-escalated requests; here the misconfiguration is at the security-level layer, meaning a low-privilege authenticated principal is treated as if it held the required role. Patchstack's advisory classifies it as a broken access control vulnerability in the plugin's 2.3.1 release. Because the flaw is authorization rather than input handling, it produces no code-execution or data-disclosure primitive on its own - the assessed impact is limited integrity and availability modification, consistent with an attacker being able to alter or disrupt booking/tour configuration data within the plugin rather than read secrets or take over the host.
Know when Wptravelly gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Network-reachable WordPress endpoint (AV:N/AC:L) exploitable by any authenticated low-privilege user (PR:L); CWE-862 yields limited integrity and availability change with no data disclosure (C:N/I:L/A:L).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Wptravelly
View allAuthentication bypass in the MagePeople WpTravelly WordPress plugin through version 2.1.7 allows remote unauthenticated
Missing authorization controls in the WpTravelly WordPress plugin (versions through 2.1.5) allow any authenticated low-p
WpTravelly tour-booking-manager plugin through version 2.1.7 allows authenticated users to access sensitive information
Exploit-DB