Description
The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, thereby exposing the original post's content, excerpt, title, taxonomies, and metadata. A Contributor can harvest a valid nonce from the Duplicate row-action on their own posts list and reuse it against any victim post ID, since the nonce action is the static string 'TTBM_Admin.php' and is not bound to any specific post.
Published: 2026-10-28
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized post duplication and potential data exposure
Action: Apply Patch
AI Analysis

Impact

The vulnerability is an authorization bypass (CWE-862) that permits authenticated users with contributor-level access or higher to duplicate any post, including private, draft, or pending content created by administrators or editors. As a result, the attacker can create copies of confidential posts in their own draft space, exposing sensitive titles, excerpts, taxonomies, and metadata to unintended users.

Affected Systems

Affected is the Travelly – Tour & Travel Booking Manager for WooCommerce plugin by MagePeopleTeam for WordPress, all releases up to and including version 2.3.6.

Risk and Exploitability

The CVSS score is 4.3, indicating a moderate impact, and the EPSS score is not available, with no KEV listing. Exploitation requires a logged‑in contributor who harvests a static nonce from the duplicate row action and reuses it against any target post ID, allowing the attacker to trigger the duplication request via the web interface.

Generated by OpenCVE AI on October 28, 2026 at 08:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the Travelly plugin to the latest release that resolves the authorization bypass (at least v2.3.7).
  • If an update is unavailable, revoke or limit Contributor and higher roles from accessing the duplicate functionality by disabling or removing the row‑action for those roles.
  • Monitor the site for suspicious duplicate requests and consider temporarily disabling the duplicate capability until a patch or code fix is applied.

Generated by OpenCVE AI on October 28, 2026 at 08:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.6 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to duplicate arbitrary posts — including private, draft, and pending posts authored by Administrators and Editors — into drafts they own, thereby exposing the original post's content, excerpt, title, taxonomies, and metadata. A Contributor can harvest a valid nonce from the Duplicate row-action on their own posts list and reuse it against any victim post ID, since the nonce action is the static string 'TTBM_Admin.php' and is not bound to any specific post.
Title Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter
Weaknesses CWE-862
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-28T06:45:15.536Z

Reserved: 2026-10-15T18:13:52.561Z

Link: CVE-2026-111213

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T07:16:46.990

Modified: 2026-10-28T07:16:46.990

Link: CVE-2026-111213

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T08:45:14Z

Weaknesses