# CVE-2026-120839: Magepeople WpTravelly local file inclusion vulnerability

Source: https://junglewise.ai/threats/cve-2026-120839-improper-control-of-filename-for-include-require-statement-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-120839 · Severity: high · CVSS 8.8 · Published 2026-11-07

WpTravelly is a WordPress plugin for managing tour bookings. A local file inclusion vulnerability allows attackers with contributor-level access to cause the site to load and potentially expose sensitive files from the server, potentially leading to site compromise or data exposure.

Technologies: [Magepeople inc. WpTravelly tour-booking-manager](https://junglewise.ai/threats/technologies/wptravelly-tour-booking-manager). Vendors: [Magepeople inc.](https://junglewise.ai/threats/vendors/magepeople-inc).

## Quick answers

**Is CVE-2026-120839 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120839 being exploited in the wild.

**How severe is CVE-2026-120839?** High severity, with a CVSS score of 8.8, published 7 November 2026.

**Which products and versions are affected?** Magepeople inc. WpTravelly tour-booking-manager through 2.3.8.

**Is there a fix for CVE-2026-120839?** Yes: fixed in 2.3.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120839 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120839?** Check whether you run Magepeople inc. WpTravelly tour-booking-manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.10

## Technical details

The vulnerability is a local file inclusion (LFI) flaw in the PHP code that improperly controls filenames for include/require statements. An attacker with contributor or higher privileges can manipulate file paths to load arbitrary files from the server filesystem. No remote unauthenticated exploitation is possible; the attack requires at least contributor-level access to the WordPress site.

## Affected products

- Magepeople inc. WpTravelly (tour-booking-manager) through 2.3.8

## Timeline

- 2026-11-07: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-2-3-8-local-file-inclusion-vulnerability-2?_s_id=cve](https://patchstack.com/database/wordpress/plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-2-3-8-local-file-inclusion-vulnerability-2?_s_id=cve)

## Related threats

- [Magepeople WpTravelly local file inclusion in tour-booking-manager](https://junglewise.ai/threats/cve-2026-120841-improper-control-of-filename-for-include-require-statement-in)
- [Magepeople WpTravelly tour-booking-manager broken access control](https://junglewise.ai/threats/cve-2026-111849-missing-authorization-vulnerability-in-magepeople-inc-wptravelly)
- [Magepeople WpTravelly tour-booking-manager broken access control](https://junglewise.ai/threats/cve-2026-62063-missing-authorization-vulnerability-in-magepeople-inc-wptravelly)