Authorization Bypass Vulnerability in Travelly – Tour & Travel Booking Manager for WooCommerce

CVE-2026-121794

What is CVE-2026-121794?

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin contains a vulnerability that allows authenticated attackers with contributor-level access or higher to bypass authorization checks. This flaw enables them to access sensitive WooCommerce payment gateway credentials including PayPal API credentials and Stripe secret keys, which are exposed directly in the raw HTML response of the tour edit screen. The vulnerability arises from improper verification of user permissions, making it trivial for attackers to retrieve these secrets by viewing the page source.

References