WhatBrokeToday
FAQ
Today's Trends
highInvestigatingWordPressvn/a through 2.3.8

WpTravelly tour-booking-manager PHP Local File Inclusion Vulnerabilities

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

High-severity vulnerabilities (CVE-2026-120839 and CVE-2026-120841) exist in the Magepeople inc. WpTravelly tour-booking-manager for PHP due to improper control of filenames for include/require statements, leading to PHP Local File Inclusion. These issues affect versions from n/a through 2.3.8.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion' / Local File Inclusion).

Evidence

2 reports · 2 CVEShow
  1. [1]
    CVE First report
    PHP Program ('PHP Remote File Inclusion') vulnerability in: CVE-2026-120839 (High)(opens security advisory in a new tab)

    High severity. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

    by Tenable 0upvotes 0comments

  2. [2]
    CVE
    PHP Program ('PHP Remote File Inclusion') vulnerability in: CVE-2026-120841 (High)(opens security advisory in a new tab)

    High severity. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8.

    by Tenable 0upvotes 0comments100% match

Timeline

  1. First report on security advisory

    PHP Program ('PHP Remote File Inclusion') vulnerability in: CVE-2026-120839 (High)

    Source