Description

The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.11 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to view stored WooCommerce payment gateway credentials — including PayPal API username, password, and signature, as well as Stripe test and live secret keys — injected verbatim into the HTML response of the tour edit screen. The credentials are present in the raw HTTP response regardless of the modal's CSS visibility state, making them trivially accessible by viewing page source.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-11-06T09:17:00.653Z",
  "pubdate": "2026-11-06T09:17:00.653Z",
  "executiveSummary": "The Travelly – Tour & Travel Booking Manager for WooCommerce plugin for WordPress is susceptible to an authorization bypass vulnerability affecting all versions up to and including 2.3.11. The security flaw stems from the application's failure to perform adequate access control checks during the rendering of the tour edit interface. Consequently, authenticated users with contributor-level privileges or higher can gain unauthorized access to sensitive WooCommerce payment gateway configurations.\nThe exposure includes critical plaintext credentials such as PayPal API usernames, passwords, and signatures, as well as Stripe test and live secret keys. These credentials are embedded directly within the HTML source code of the tour editing page, rendering them visible to any user capable of accessing that view, irrespective of UI-level CSS restrictions or modal visibility. This constitutes a severe information disclosure vulnerability, as it allows low-privileged users to exfiltrate sensitive financial service tokens, potentially leading to total compromise of payment processing integrity. The risk is critical, as it bypasses standard administrative barriers and provides attackers with the necessary data to perform fraudulent transactions or disrupt payment operations.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the plugin’s authorization logic, which fails to enforce strict capability checks when generating the server-side response for the tour edit screen. In the affected versions of the Travelly plugin, the backend code retrieves WooCommerce payment gateway settings and injects them into the HTTP response body intended for the tour management dashboard. Because the authentication middleware does not validate that the requesting user possesses administrative capabilities, the application treats contributor-level sessions as authorized contexts to view these sensitive configurations.\nExploitation is highly trivial and does not require specialized tools beyond a standard web browser. An attacker with a registered contributor account logs into the WordPress environment and navigates to the tour edit page provided by the Travelly plugin. Although the user interface may attempt to obscure these credentials using CSS-based modal hiding, the backend renders the sensitive data directly into the raw HTML. The attack flow follows these steps: First, the attacker initiates a GET request to the tour edit endpoint. Second, the plugin server-side logic processes the request and executes the data retrieval function, which fetches the global WooCommerce gateway settings. Third, the plugin injects these variables—specifically the PayPal and Stripe API keys—into the HTML payload. Fourth, the attacker accesses the page source or uses the browser's developer tools to inspect the returned DOM structure. Because the sensitive information is present in the verbatim HTTP response, the CSS visibility state is irrelevant to the retrieval of the plaintext tokens.\nThe scope of the impact is comprehensive. By extracting Stripe secret keys and PayPal credentials, an adversary can manipulate payment workflows, redirect funds, intercept transaction metadata, or gain unauthorized administrative access to the associated payment provider accounts. The vulnerability demonstrates a fundamental flaw in secure coding practices where sensitive server-side configuration data is prematurely leaked into the client-side markup, completely undermining the security of the payment processing layer. The absence of server-side capability verification allows for persistent access to these credentials as long as the user maintains a contributor account on the WordPress installation."
}