The vulnerability arises from improper control of a filename used in a PHP include/require statement within WpTravelly’s tour‑booking‑manager plugin. This flaw, classified as CWE‑98, enables the plugin to read or potentially execute files located on the server, which may lead to disclosure of sensitive configuration data or the execution of unintended code. The impact is confined to the web application hosting the plugin, with a high severity due to the possible compromise of configuration and source files.

WpTravelly tour‑booking‑manager versions up through 1.8.7 are affected. No other vendors or product families are listed; all installations using these releases are impacted.

The CVSS score of 8.8 indicates a high level of severity, while the EPSS score of 2% indicates a low current likelihood of exploitation. The vulnerability is not present in CISA’s KEV catalog. Likely attack vectors involve web‑accessible paths that accept a file name parameter, which the plugin then passes to an include/require call without validation. Based on the description, it is inferred that an attacker could read arbitrary local files and that, depending on server configuration, executing PHP code through this path might be possible.