CVE-2026-39565

MediumCVSS 4.3

Published: 08/04/2026(UTC)Updated: 20/07/2026(UTC)Translated: 22/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The WpTravelly tour booking manager plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.

Risk Assessment

An attacker may gain unauthorized access to administrative functions or sensitive data, potentially leading to confidentiality and integrity breaches.

Recommendation

It is recommended to immediately update the WpTravelly plugin to the latest available version that fixes this vulnerability.

Original NVD description (English source)

Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.