PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-111849 Magepeople inc. CVE debrief

PatchSiren debrief of CVE-2026-111849: The WpTravelly plugin for WordPress has a Broken Access Control vulnerability in versions up to 2.3.5. This issue allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions on WordPress sites using the plugin. Site administrators should verify exposure, assess site security, and prioritize patching to prevent potential security issues. The CVE record and source item provide details on the vulnerability, but additional verification is necessary to confirm affected scope and severity.

Vendor
Magepeople inc.
Product
WpTravelly
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-21
Original CVE updated
2026-10-21
Advisory published
2026-10-21
Advisory updated
2026-10-21

Who should care

WordPress site administrators and security teams should assess exposure and prioritize patching. They should verify WpTravelly plugin version and update to 2.3.6 or later if necessary to prevent potential security issues. Additionally, they should review and adjust WordPress site access controls and user permissions to ensure proper security levels and monitor site security logs for suspicious activity related to the

Why it matters

CVE-2026-111849 is a Medium-severity vulnerability in the WpTravelly plugin for WordPress. Site administrators should verify exposure, assess site security, and prioritize patching to prevent potential security issues.

  • Verify WpTravelly plugin version and update to 2.3.6 or later if necessary to prevent potential security issues
  • Review and adjust WordPress site access controls and user permissions to ensure proper security levels
  • Monitor site security logs for suspicious activity related to the WpTravelly plugin

Technical summary

The WpTravelly plugin for WordPress has a Broken Access Control vulnerability in versions up to 2.3.5. This issue allows attackers to exploit incorrectly configured access control security levels, potentially leading to unauthorized actions on WordPress sites using the plugin. The vulnerability is considered Medium-severity with a CVSS score of 5.3. Site administrators should review and adjust WordPress site access controls and user permissions to ensure proper security levels.

Defensive priority

Medium priority for WordPress site administrators and security teams

Recommended defensive actions

  • Verify WpTravelly plugin version and update to 2.3.6 or later if necessary
  • Review WordPress site access controls and user permissions
  • Monitor site security logs for suspicious activity

Evidence notes

The CVE record and source item provide details on the Broken Access Control vulnerability in WpTravelly plugin versions up to 2.3.5. The NVD entry is currently UNVERIFIED.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-111849 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-111849

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-111849 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111849

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.