CVE-2026-62063
MediumCVSS 5.4Summary
WpTravelly plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.3.1.
Risk Assessment
Unauthorized access to administrative functions or data, potentially leading to system integrity compromise.
Recommendation
Update the plugin to the latest version and review permission configuration to ensure proper authorization.
Other vulnerabilities in WpTravelly
See all- CVE-2026-27089High
There is an unauthenticated bypass vulnerability in WpTravelly versions up to 2.1.7.
- CVE-2026-27331Medium
The WpTravelly plugin for WordPress up to version 2.1.5 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.
- CVE-2026-39565Medium
The WpTravelly tour booking manager plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.
Original NVD description (English source)
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS