TI-2026-81753 Aliases CVE-2026-111213 GHSA-9x7v-j6m2-2h5m

Missing authorization in Travelly lets contributors duplicate posts

LOW 19CWE-862Published 2026-10-28 · Updated 2026-10-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Travelly (Tour & Travel Booking Manager for WooCommerce) versions up to and including 2.3.6 are affected. A missing authorization check (CWE-862) lets authenticated users act on posts they do not own. An attacker with Contributor access or higher can duplicate private, draft and pending posts by Administrators and Editors into drafts they own, exposing their content, excerpt, title, taxonomies and metadata.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, thereby exposing the original post's content, excerpt, title, taxonomies, and metadata. A Contributor can harvest a valid nonce from the Duplicate row-action on their own posts list and reuse it against any victim post ID, since the nonce action is the static string 'TTBM_Admin.php' and is not bound to any specific post.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00222 12th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
magepeopleteam	Travelly – Tour & Travel Booking Manager for WooCommerce	up to 2.3.6	—	No fix listed	CNA

Travelly – Tour & Travel Booking Manager for WooCommerce Vendormagepeopleteam Affected up to 2.3.6 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Travelly (Tour & Travel Booking Manager for WooCommerce).

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

2026-10-28 Threatist record created from CVE-2026-111213
2026-10-28 Alias added: GHSA-9x7v-j6m2-2h5m
2026-10-29 CISA SSVC decision points changed

References

Other 6

TI-2023-00139 Event Manager and Tickets Selling Plugin for WooCommerce < 3.8.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
TI-2025-23672 WordPress WpBookingly plugin <= 1.3.0 - PHP Object Injection vulnerability CVSS 3.1CRITICAL 9.8
TI-2025-34476 WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability CVSS 3.1CRITICAL 9.8
TI-2025-08146 Missing authorization in magepeopleteam E-cab Taxi Booking Manager for Woocommerce CVSS 3.1CRITICAL 9.8
TI-2026-21554 WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.6.0 - PHP Object Injection vulnerability CVSS 3.1CRITICAL 9.8
TI-2026-18971 WordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability CVSS 3.1CRITICAL 9.8

See all 72 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences