CVE-2026-27331
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The WpTravelly plugin for WordPress up to version 2.1.5 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.
Risk Assessment
An attacker can gain unauthorized access to administrative functions or data, potentially leading to privilege escalation.
Recommendation
Update the WpTravelly plugin to the latest version and implement proper access controls.
Other vulnerabilities in WpTravelly
See all- CVE-2026-27089High
There is an unauthenticated bypass vulnerability in WpTravelly versions up to 2.1.7.
- CVE-2026-39565Medium
The WpTravelly tour booking manager plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. WpTravelly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpTravelly: from n/a through 2.1.5.