PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-27331 Magepeople inc. CVE debrief

A Missing Authorization vulnerability in the WpTravelly WordPress plugin (versions through 2.1.5) allows authenticated attackers to exploit incorrectly configured access control security levels. The vulnerability is classified as CWE-862 (Missing Authorization) with a CVSS 3.1 score of 6.3 (MEDIUM severity). The affected product is WpTravelly, a tour booking manager plugin published by Magepeople inc. The NVD entry currently shows a status of 'Deferred,' indicating the record may be awaiting additional analysis or vendor coordination. No known exploitation in ransomware campaigns has been documented, and the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog.

Vendor
Magepeople inc.
Product
WpTravelly
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-26
Original CVE updated
2026-05-26
Advisory published
2026-05-26
Advisory updated
2026-05-26

Who should care

WordPress site administrators using the WpTravelly tour booking plugin; security teams managing WordPress estates; developers maintaining custom integrations with WpTravelly

Technical summary

The WpTravelly plugin for WordPress fails to properly enforce authorization checks on certain functionality, allowing authenticated users with low privileges to access or modify resources beyond their intended permissions. The vulnerability affects all versions up to and including 2.1.5. Attack vector is network-based with low attack complexity, requiring low-privileged user authentication but no user interaction. Impact is rated as low for confidentiality, integrity, and availability.

Defensive priority

medium

Recommended defensive actions

  • Review WordPress installations for WpTravelly plugin versions 2.1.5 or earlier and prioritize updates if available from the vendor
  • Monitor the Patchstack advisory and vendor channels for security patch release
  • Apply principle of least privilege to WordPress user accounts pending patch availability
  • Consider Web Application Firewall (WAF) rules to restrict unauthorized access to plugin administrative functions if patching is delayed

Evidence notes

Vulnerability identified via Patchstack and submitted to NVD with CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. NVD status is 'Deferred' as of disclosure date. Vendor attribution to Magepeople inc. derived from reference domain analysis with low confidence; vendor name marked for review.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-27331 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-27331

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-27331 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-27331

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.