Wptravelly EUVD-2026-20211

WpTravelly is a WordPress plugin for tour and booking management distributed by magepeopleteam. The vulnerability stems from CWE-862 (Missing Authorization), a common web application flaw where access control checks are either absent or improperly configured. Authenticated users can bypass authorization controls intended to restrict access to specific functionality or data, allowing them to view information outside their intended permission scope. This is distinct from authentication bypass (CWE-287) because the attacker must possess valid credentials; the issue is in authorization logic after successful authentication. The plugin architecture allows users with basic roles (e.g., subscriber, contributor) to interact with tour booking data and administrative functions that should be restricted to higher-privilege accounts (administrators, tour operators).