{"id":"CVE-2026-120841","published":"2026-11-07T13:16:35.130","lastModified":"2026-11-07T19:17:22.090","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-98"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-2-3-8-local-file-inclusion-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an authenticated attacker with low privileges to include arbitrary local files on the server via improper filename handling in PHP's include/require statements, leading to potential exposure of sensitive data, code execution, or full system compromise.","exploitability":"Exploitation requires valid low-privilege authentication and knowledge of a vulnerable file path; no public exploit is available, but the flaw is straightforward to trigger if the input is controllable.","blast_radius":"Successful exploitation could lead to full confidentiality, integrity, and availability impact including credential theft, remote code execution via uploaded files, or server takeover.","remediation":"Upgrade to WpTravelly version 2.3.9 or later, as the vendor has not released a patched version beyond 2.3.8 per the description.","detection":"Defenders should monitor web server access logs for requests containing suspicious file paths (e.g., ../../etc/passwd, php://filter) in parameters passed to include/require endpoints, especially from authenticated users with minimal privileges; look for HTTP 500 errors or unexpected file reads in PHP error logs.","tags":["lfi","php","webapp","auth-bypass","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:53:43.167Z"}}