CVE-2026-27089: WpTravelly Auth Bypass Vulnerability

CVE-2026-27089 Overview

CVE-2026-27089 is an unauthenticated bypass vulnerability affecting the WpTravelly (Tour Booking Manager) WordPress plugin in versions up to and including 2.1.7. The flaw is categorized under [CWE-290] Authentication Bypass by Spoofing. An unauthenticated remote attacker can exploit the issue over the network without user interaction. Successful exploitation allows the attacker to bypass intended authentication or authorization checks and tamper with data managed by the plugin. The integrity impact is high while confidentiality and availability remain unaffected. Site administrators running the WpTravelly plugin should treat this issue as a priority for remediation.

Critical Impact
Unauthenticated attackers can bypass authentication controls in WpTravelly <= 2.1.7 and modify booking data through network-accessible WordPress endpoints.

Affected Products

WpTravelly (Tour Booking Manager) WordPress plugin versions <= 2.1.7
WordPress sites running the vulnerable plugin with default configuration
Tour and booking management deployments depending on the plugin

Discovery Timeline

2026-06-15 - CVE-2026-27089 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-27089

Vulnerability Analysis

The vulnerability resides in the WpTravelly plugin's request handling logic, where an authentication or authorization check can be bypassed by an unauthenticated remote actor. Because the flaw maps to [CWE-290], the plugin trusts attacker-controllable input as proof of identity or privilege rather than enforcing a server-side check. Network reachability is the only prerequisite for exploitation, and no user interaction is required. According to the EPSS model, the probability of exploitation in the next 30 days is currently low, but the unauthenticated nature of the bug makes opportunistic scanning likely once technical details circulate. The impact is scoped to integrity, indicating that attackers can alter records, settings, or workflow state inside the plugin rather than read sensitive data or take the site offline.

Root Cause

The root cause is improper verification of the requester's identity within plugin endpoints exposed to anonymous WordPress traffic. The plugin accepts a request parameter or token that should authenticate the caller but fails to validate it against a trusted source. This allows the attacker to spoof a legitimate identity and reach privileged code paths.

Attack Vector

An attacker sends a crafted HTTP request to a WpTravelly endpoint reachable via the WordPress front controller. Because the plugin does not enforce a proper authentication check, the request is processed as if it came from an authorized user. The attacker can then invoke functions that modify booking data or plugin state. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27089

Indicators of Compromise

Unexpected modifications to bookings, tours, or plugin settings without a corresponding administrator session in WordPress audit logs.
HTTP requests to WpTravelly action handlers (typically admin-ajax.php or plugin-specific REST routes) originating from unauthenticated sessions.
Spikes in POST traffic to the plugin's endpoints from a small set of source IPs.

Detection Strategies

Inspect web server access logs for repeated requests targeting WpTravelly action names or REST namespaces without an authenticated wordpress_logged_in_* cookie.
Correlate plugin-level data changes with the absence of administrative login events in the same timeframe.
Deploy a Web Application Firewall (WAF) rule that flags requests to vulnerable endpoints originating from anonymous sessions.

Monitoring Recommendations

Enable verbose logging in WordPress and the WpTravelly plugin to capture user context for every state-changing action.
Forward WordPress and reverse proxy logs to a centralized analytics platform and alert on anonymous writes to plugin tables.
Track plugin version inventory across all WordPress instances and alert when versions <= 2.1.7 are detected.

How to Mitigate CVE-2026-27089

Immediate Actions Required

Identify every WordPress site running the WpTravelly (Tour Booking Manager) plugin and confirm the installed version.
Update the plugin to a release later than 2.1.7 as soon as the vendor publishes a fixed version.
Restrict network access to the WordPress admin and plugin endpoints to trusted IP ranges where feasible.
Audit booking, tour, and configuration tables for unauthorized changes since the plugin was deployed.

Patch Information

Review the Patchstack Vulnerability Report for the current patched version and upgrade guidance. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin directory on disk, then verify the reported version in the WordPress admin dashboard.

Workarounds

Deactivate the WpTravelly plugin until a patched release is installed if booking functionality is non-critical.
Add WAF rules to block unauthenticated requests to known WpTravelly action handlers and REST routes.
Enforce HTTP authentication or IP allow-listing on wp-admin and admin-ajax.php at the reverse proxy layer.

bash

# Example NGINX rule to block unauthenticated access to WpTravelly endpoints
location ~* /wp-admin/admin-ajax\.php$ {
    if ($arg_action ~* "^wptravelly_") {
        # Require a valid logged-in cookie before proxying
        if ($http_cookie !~* "wordpress_logged_in_") {
            return 403;
        }
    }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}