Authorization Bypass Vulnerability in Travelly – Tour & Travel Booking Manager for WooCommerce

CVE-2026-111213

What is CVE-2026-111213?

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin is susceptible to an authorization bypass flaw present in all versions up to 2.3.6. This vulnerability arises from inadequate verification processes regarding user permissions. Authenticated attackers with contributor-level access can exploit this weakness to duplicate any posts—including private, draft, and pending posts originally authored by Admins and Editors—into their own drafts. Consequently, attackers are able to access content, excerpts, titles, taxonomies, and metadata belonging to these posts. By exploiting the static nonce action 'TTBM_Admin.php', contributors can harvest valid nonces and apply them to any victim post ID, thereby posing a significant threat to content confidentiality.

References