WpTravelly EUVD-2026-107214

Exploitation requires that the target WordPress site have the Magepeople WpTravelly (tour-booking-manager) plugin installed and active at version through 2.3.5. The flaw is a missing authorization check (CWE-862), so no authentication, no special configuration, and no user interaction are needed - remote unauthenticated requests reach the vulnerable functionality against default installs. The primary limiting factors are the requirement that the specific vulnerable plugin be present and the constrained impact: only unauthorized read access to data (C:L) is achievable, with no write/modify or denial-of-service capability.

This is a moderate, not high, priority issue. The CVSS 3.1 base score is 5.3 (MEDIUM) with vector AV:N/AC:L/PR:N/UI:N, indicating remote, low-complexity, unauthenticated exploitation requiring no user interaction - favorable conditions for an attacker. However, the impact is deliberately constrained: C:L/I:N/A:N means only a limited confidentiality breach (unauthorized read access to some data) with no integrity or availability impact, consistent with CWE-862 Missing Authorization. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no signal of active or probable exploitation; exploitation status is therefore 'no public exploit identified at time of analysis.' There are no conflicting signals in the data, but note the absence of EPSS/KEV/POC means real-world exploitation likelihood cannot be quantified from the input alone - the only corroborating source is the Patchstack advisory. Net assessment: a genuine but low-to-moderate access-control flaw whose limited blast radius (information disclosure only) and niche product footprint keep it below the priority of integrity- or RCE-class vulnerabilities.

A remote, unauthenticated attacker sends a crafted HTTP request to a WordPress site running the WpTravelly tour-booking-manager plugin (≤2.3.5), reaching a plugin endpoint that fails to perform a capability/authorization check. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no credentials or victim interaction are needed, and the attacker retrieves data (C:L) that should have been access-restricted. No public exploit code was identified in the provided data.