The vulnerability identified as CVE-2026-62063 in Magepeople inc. WpTravelly is due to missing authorization controls. This flaw allows users with limited privileges to perform actions that should be restricted, caused by incorrectly configured access control security levels. The affected versions include all releases prior to 2.3.2. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and high availability impact.

Exploitation of this vulnerability can lead to unauthorized actions that impact the integrity and availability of the affected system. There is no confidentiality impact. The medium severity score reflects the potential for limited privilege users to cause integrity and availability issues within the WpTravelly plugin.

No official patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin's administrative functions to trusted users only and monitor for unusual activity related to tour booking management.