A flaw in the WordPress WpTravelly tour‑booking‑manager plugin allows an attacker to supply a filename for use in a PHP include or require statement. Because the plugin does not sanitize the path, the attacker can cause the server to read arbitrary local files or execute malicious code stored on the system. This vulnerability can compromise the confidentiality of sensitive files, alter the integrity of the web application, and potentially provide full control over the server if the included payload is executed.

The issue affects the Magepeople inc. WpTravelly tour‑booking‑manager plugin in all versions up to and including 2.3.8. WordPress sites that have installed or left any of these versions installed are exposed to the vulnerability.

The flaw carries a CVSS score of 8.8, indicating high severity. No EPSS score is available, but the lack of hardening in the current plugin version means attackers can exploit the vulnerability remotely through crafted HTTP requests that trigger the vulnerable include. It is not listed in the CISA KEV catalog; however, the high CVSS and the potential for remote code execution make it a critical risk that should be addressed promptly. The likely attack vector is via remote web requests that provide malicious parameters to the plugin's file inclusion logic.