CVE-2026-120841 is a high-severity vulnerability in the WpTravelly tour-booking-manager plugin by Magepeople inc. It involves improper control of filenames used in PHP include/require statements, leading to PHP Local File Inclusion (LFI). This flaw affects versions up to and including 2.3.8 of WpTravelly. The vulnerability allows an attacker with low privileges to cause high impact on confidentiality, integrity, and availability without user interaction.