A vulnerability in the WpTravelly tour-booking-manager plugin by Magepeople inc. allows improper control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion. This affects versions up to 2.3.8. The vulnerability has a high severity with a CVSS score of 8.8, indicating potential for significant impact on confidentiality, integrity, and availability.