CVE-2026-27089: WordPress WpTravelly plugin <= 2.1.7 - Bypass Vulnerability vulnerability

Synopsis

An authentication bypass vulnerability affects the WpTravelly WordPress plugin by Magepeople Inc. in versions 2.1.7 and earlier. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially accessible to any remote attacker. Successful exploitation grants the attacker the ability to tamper with site data or application logic, achieving high-integrity impact without any credentials. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; any internet-facing WordPress instance running WpTravelly is exposed.

• AuthenticationNot required

  No account or session credentials are needed; the attacker can reach the vulnerable code path as an unauthenticated visitor.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is fully self-contained.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special timing, or environmental preconditions.

Blast Radius

• The attacker bypasses access controls that would normally gate privileged operations within the WpTravelly plugin.
• Plugin data, travel listings, pricing records, or booking configurations can be modified or corrupted without any prior login.
• Site integrity is compromised, enabling persistent changes to content or settings that persist across user sessions.