CVE-2026-121794

Name of the Vulnerable Software and Affected Versions The Travelly – Tour & Travel Booking Manager for WooCommerce versions prior to 2.3.12

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with contributor-level access or higher can view stored WooCommerce payment gateway credentials, such as PayPal API username, password, and signature, and Stripe test and live secret keys. These credentials are injected directly into the HTML response of the tour edit screen and can be accessed via the raw HTTP response by viewing the page source, regardless of the CSS visibility of the modal.

Recommendations Update The Travelly – Tour & Travel Booking Manager for WooCommerce to version 2.3.12 or later.