CVE-2026-120841 – WordPress WpTravelly plugin

​CVE ID :CVE-2026-120841

Published : Nov. 7, 2026, 1:16 p.m. | 4 hours, 57 minutes ago

Description :Improper Control of Filename for Include/Require Statement in PHP Program (‘PHP Remote File Inclusion’) vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

Severity: 8.8 | HIGH

Visit the link for more details, such as CVSS details, affected products, timeline, and more… To Read More Visit Read More