{"id":"CVE-2026-120839","published":"2026-11-07T13:16:34.973","lastModified":"2026-11-07T19:17:21.873","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-2-3-8-local-file-inclusion-vulnerability-2?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The WpTravelly plugin for WordPress contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filenames in include/require statements, allowing an authenticated low-privileged user to read arbitrary local files on the server. This is classified as CWE-98 and rated CVSS 8.8 due to high confidentiality, integrity, and availability impact.","exploitability":"Exploitation requires valid low-privilege authentication (e.g., subscriber-level access) and knowledge of local file paths; no public exploit code is available.","blast_radius":"Successful exploitation could lead to full system compromise via disclosure of sensitive files (e.g., wp-config.php), credential theft, or potential remote code execution if combined with other vulnerabilities.","remediation":"Upgrade to WpTravelly version 2.3.9 or later, as the vulnerability is fixed in that release.","detection":"Defenders should monitor WordPress debug logs and web server access logs for requests containing suspicious path traversal sequences (e.g., ../../../wp-config.php) in parameters passed to include/require endpoints; however, no specific log field or artifact is uniquely attributable to this CVE per the published description.","tags":["lfi","php","webapp","auth-bypass","file-disclosure"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:53:35.671Z"}}