The WpTravelly plugin performs PHP include/require operations on filenames supplied by user input without proper validation or sanitization. This flaw creates an improper control of the filename used in the include statement, allowing an attacker to trigger a PHP Remote File Inclusion. The result may be that attacker‑controlled code is executed on the server or that sensitive local files are read, potentially giving the attacker access to confidential data or a foothold for further compromise.

Magepeople inc. WpTravelly tour‑booking‑manager plugin, version 2.3.8 and earlier. The vulnerability is present in all releases that have not applied the patch; the fix is included starting with version 2.3.10.

The CVSS score of 8.8 reflects a high severity scenario in which remote exploitation is possible. The EPSS score is not available, and the issue is not listed in CISA KEV. Attackers can exploit this flaw by sending a crafted HTTP request that specifies an arbitrary filename to the plugin’s source code, triggering the PHP include chain. Because the vulnerability is reachable from the web interface, it can be leveraged by unauthenticated users or those with limited privileges.