CVE-2026-120841

Summary

This vulnerability allows an authenticated attacker with low privileges to include arbitrary local files on the server via improper filename handling in PHP's include/require statements, leading to potential exposure of sensitive data, code execution, or full system compromise.

Exploitability

Exploitation requires valid low-privilege authentication and knowledge of a vulnerable file path; no public exploit is available, but the flaw is straightforward to trigger if the input is controllable.

Blast radius

Successful exploitation could lead to full confidentiality, integrity, and availability impact including credential theft, remote code execution via uploaded files, or server takeover.

Detection

Defenders should monitor web server access logs for requests containing suspicious file paths (e.g., ../../etc/passwd, php://filter) in parameters passed to include/require endpoints, especially from authenticated users with minimal privileges; look for HTTP 500 errors or unexpected file reads in PHP error logs.

Prioritized remediation

Upgrade to WpTravelly version 2.3.9 or later, as the vendor has not released a patched version beyond 2.3.8 per the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.