PHP Remote File Inclusion Vulnerability in WpTravelly by Magepeople Inc.

CVE-2026-120839

What is CVE-2026-120839?

A remote file inclusion vulnerability has been identified in the WpTravelly tour-booking manager plugin developed by Magepeople Inc. This flaw arises from improper control of the filename for include or require statements in PHP, allowing for potential local file inclusion attacks. Attackers could exploit this vulnerability to execute malicious PHP code, potentially leading to unauthorized access and data compromise. The issue affects WpTravelly versions prior to 2.3.8, highlighting the importance of timely updates and security measures for WordPress administrators.

References