# CVE-2026-120841: Magepeople WpTravelly local file inclusion in tour-booking-manager

Source: https://junglewise.ai/threats/cve-2026-120841-improper-control-of-filename-for-include-require-statement-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-07. Updated: 2026-11-07  
License: CC BY 4.0 with a link back

CVE-2026-120841 · Severity: high · CVSS 8.8 · Published 2026-11-07

WpTravelly is a WordPress plugin for managing tour bookings and customer reservations. A local file inclusion flaw allows attackers to read sensitive files from the server, potentially exposing configuration data, credentials, and other confidential information that could lead to account takeover or full site compromise.

Technologies: [Magepeople inc. WpTravelly tour-booking-manager](https://junglewise.ai/threats/technologies/wptravelly-tour-booking-manager). Vendors: [Magepeople inc.](https://junglewise.ai/threats/vendors/magepeople-inc).

## Quick answers

**Is CVE-2026-120841 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120841 being exploited in the wild.

**How severe is CVE-2026-120841?** High severity, with a CVSS score of 8.8, published 7 November 2026.

**Which products and versions are affected?** Magepeople inc. WpTravelly tour-booking-manager through 2.3.8.

**Is there a fix for CVE-2026-120841?** Yes: fixed in 2.3.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120841 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-120841?** Check whether you run Magepeople inc. WpTravelly tour-booking-manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.3.10

## Technical details

The plugin improperly controls filename parameters in PHP include/require statements, enabling local file inclusion (LFI). An attacker can exploit this via improper parameter control to read arbitrary server files. A fix is available in version 2.3.10.

## Affected products

- Magepeople inc. WpTravelly tour-booking-manager through 2.3.8

## Timeline

- 2026-11-07: disclosed

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-2-3-8-local-file-inclusion-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-2-3-8-local-file-inclusion-vulnerability?_s_id=cve)

## Related threats

- [Magepeople WpTravelly local file inclusion vulnerability](https://junglewise.ai/threats/cve-2026-120839-improper-control-of-filename-for-include-require-statement-in)
- [Magepeople WpTravelly tour-booking-manager broken access control](https://junglewise.ai/threats/cve-2026-111849-missing-authorization-vulnerability-in-magepeople-inc-wptravelly)
- [Magepeople WpTravelly tour-booking-manager broken access control](https://junglewise.ai/threats/cve-2026-62063-missing-authorization-vulnerability-in-magepeople-inc-wptravelly)