PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27089 Magepeople inc. CVE debrief

CVE-2026-27089 is a HIGH severity vulnerability (CVSS Score: 7.5) in the WpTravelly plugin versions <= 2.1.7. The vulnerability is described as an unauthenticated bypass vulnerability. The CVE was published on 2026-06-15T21:16:40.767Z and last modified on 2026-06-15T21:24:32.790Z. The vendor and product information is not confirmed, but there is a reference to Patchstack as a potential source.

Vendor
Magepeople inc.
Product
WpTravelly
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-15
Advisory published
2026-06-15
Advisory updated
2026-06-15

Who should care

Users of WpTravelly plugin versions <= 2.1.7 should be aware of this vulnerability and take necessary actions to mitigate the risk.

Technical summary

The vulnerability has a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N and is classified under CWE-290. It was reported by [email protected].

Defensive priority

HIGH

Recommended defensive actions

  • Update WpTravelly plugin to a version greater than 2.1.7 if available.
  • Refer to [ref-4](https://patchstack.com/database/wordpress/plugin/tour-booking-manager/vulnerability/wordpress-wptravelly-plugin-2-1-7-bypass-vulnerability-vulnerability?_s_id=cve) for mitigation or vendor reference.

Evidence notes

The CVE record [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-27089) and NVD detail [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-27089) provide additional information.

Official resources

CVE-2026-27089 was published on 2026-06-15T21:16:40.767Z and last modified on 2026-06-15T21:24:32.790Z.