CVE-2026-39565
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The WpTravelly tour booking manager plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.
Risk Assessment
An attacker may gain unauthorized access to administrative functions or sensitive data, potentially leading to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately update the WpTravelly plugin to the latest available version that fixes this vulnerability.
Other vulnerabilities in WpTravelly
See all- CVE-2026-62063Medium
WpTravelly plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control levels. Affects versions up to 2.3.1.
- CVE-2026-27089High
There is an unauthenticated bypass vulnerability in WpTravelly versions up to 2.1.7.
- CVE-2026-27331Medium
The WpTravelly plugin for WordPress up to version 2.1.5 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Missing Authorization vulnerability in magepeopleteam WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through <= 2.1.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS