CVE-2026-120839

Summary

The WpTravelly plugin for WordPress contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filenames in include/require statements, allowing an authenticated low-privileged user to read arbitrary local files on the server. This is classified as CWE-98 and rated CVSS 8.8 due to high confidentiality, integrity, and availability impact.

Exploitability

Exploitation requires valid low-privilege authentication (e.g., subscriber-level access) and knowledge of local file paths; no public exploit code is available.

Blast radius

Successful exploitation could lead to full system compromise via disclosure of sensitive files (e.g., wp-config.php), credential theft, or potential remote code execution if combined with other vulnerabilities.

Detection

Defenders should monitor WordPress debug logs and web server access logs for requests containing suspicious path traversal sequences (e.g., ../../../wp-config.php) in parameters passed to include/require endpoints; however, no specific log field or artifact is uniquely attributable to this CVE per the published description.

Prioritized remediation

Upgrade to WpTravelly version 2.3.9 or later, as the vulnerability is fixed in that release.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.