If a user does not have permissions to enter a world, if they accept a teleport request before entering a world. They will get teleported to the world they do not have permissions to.

The issue is the users permissions are checked when the teleport request is accepted rather then when they are being teleported.

How to replicate:

USER A: Sends tpa request.
Users B: Accept teleport request.
USER B: Enter restricted world while player A waits for the teleport timer.
USER A: Get teleported to the world you do not have permissions to.

Spigot 1.8.8
Essentials X: 2.0.1-b330

Zperms, same issue with PEX I believe.

Sounds like an issue with the permissions plugin not intercepting teleports.

Which permission plugin though?