CVE-2026-27089
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
There is an unauthenticated bypass vulnerability in WpTravelly versions up to 2.1.7.
Risk Assessment
An attacker could exploit this vulnerability to gain access to functions that should be protected, potentially leading to unauthorized actions within the system.
Recommendation
It is recommended to update WpTravelly to the latest version to mitigate this vulnerability.
Other vulnerabilities in WpTravelly
See all- CVE-2026-27331Medium
The WpTravelly plugin for WordPress up to version 2.1.5 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-39565Medium
The WpTravelly tour booking manager plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.
Original NVD description (English source)
Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.