Tour Booking Manager Vulnerabilities

The Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.1.7. This makes it possible for unauthenticated attackers to perform an unauthori...

CVSS:

5.3

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Jun 1, 2026

CVE-2026-27089 on NVD →

The Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.5. This makes it possible for authenticated attackers, with contributor-level acces...

CVSS:

4.3

Affected:

up to 2.1.5

Fixed in:

2.1.6

Disclosed:

May 26, 2026

CVE-2026-27331 on NVD →

The WpTravelly plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Mar 21, 2026

CVE-2026-39565 on NVD →

The WpTravelly plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.8.7 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable s...

CVSS:

8.8

Affected:

up to 1.8.7

Fixed in:

1.8.8

Disclosed:

Apr 1, 2025

CVE-2025-30892 on NVD →

The WpTravelly plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.8.7. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. Thi...

CVSS:

8.8

Affected:

up to 1.8.7

Fixed in:

1.8.8

Disclosed:

Mar 27, 2025

CVE-2025-30891 on NVD →

The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to perform actions like updating plug...

CVSS:

5.3

Affected:

up to 1.8.5

Fixed in:

1.8.6

Disclosed:

Jan 14, 2025

CVE-2025-22737 on NVD →

The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ttbm_trash_post() function in all versions up to, and including, 1.7.7. This makes it possible for unauthenticated attackers to trash posts.

CVSS:

5.3

Affected:

up to 1.7.7

Fixed in:

1.7.8

Disclosed:

Aug 9, 2024

CVE-2024-43212 on NVD →

The WordPress Tour & Travel Booking Plugin for WooCommerce – WpTravelly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ttbm_new_place_save' function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to cre...

CVSS:

5.3

Affected:

up to 1.7.1

Fixed in:

1.7.2

Disclosed:

May 28, 2024

CVE-2024-0434 on NVD →

The WpTravelly plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the quick_setup() function. This makes it possible for unauthenticated attackers to trigger a set-up via a forged request granted they can tric...

CVSS:

4.3

Affected:

up to 1.6.0

Fixed in:

1.6.1

Disclosed:

Apr 12, 2024

CVE-2024-32450 on NVD →