WP Travel Engine CVE-2025-7634
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted admin-ajax request
-
ExploitInject path via mode parameter
-
ExecutionInclude arbitrary local PHP file
-
ImpactExecute code or disclose sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V5 - File Handling File inclusion prevention, allowlisting
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Command and Control The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitable remotely and unauthenticated (PR:N, UI:N) by sending requests to the plugin's AJAX handlers (FilterTripsHtml/LoadTripsHtml per the referenced source) with a crafted 'mode' parameter that is passed into a PHP include. Affects all WP Travel Engine versions up to and including 6.6.7 in default configuration. LIMITING FACTOR: inclusion itself is constrained to .php files resolvable on the local filesystem; achieving arbitrary-code RCE (versus disclosure/execution of pre-existing server scripts) requires a separate means of placing an attacker-controlled .php file on the host, as the description explicitly notes. |
| Impact | Signals are largely consistent toward high priority for exposed instances. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a remote, unauthenticated, low-complexity flaw requiring no user interaction - the worst-case profile. CWE-98 (improper control of filename for include/require) confirms this is a PHP file-inclusion issue reachable via the 'mode' parameter in AJAX endpoints, and the references point to concrete source lines, so the root cause is well-substantiated by Wordfence (a credible WordPress-focused source). However, the EPSS score is modest at 0.80% (55th percentile), indicating no strong current signal of mass exploitation activity, and the CVE is NOT on CISA KEV with no public exploit identified at time of analysis - so active, widespread exploitation is not confirmed. The one genuine nuance to flag: the headline C:H/I:H/A:H and 'RCE' framing assume the attacker can get a .php file onto the server to include; the description itself states code execution applies 'in cases where .php file types can be uploaded and included.' Pure inclusion of existing server-side .php files yields local file disclosure and execution of already-present code, but full arbitrary-code RCE is conditional on a secondary upload primitive - verify realistic impact against the specific deployment rather than treating 9.8/RCE as unconditionally achieved. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's trip-filtering AJAX endpoint (admin-ajax.php) with a manipulated 'mode' parameter that controls a PHP include path, causing the server to include and execute a chosen local .php file. If the attacker can first plant a .php file (e.g., via an upload feature) or point the include at an existing sensitive script, this escalates from local file inclusion to arbitrary PHP code execution. No public exploit is identified at time of analysis, but the vulnerable code paths are published in the referenced plugin source. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Unauthenticated local file inclusion in the WordPress plugin WP Travel Engine (Tour Booking Plugin / Tour Operator Software) affects all versions up to and including 6.6.7: remote attackers can supply a crafted 'mode' parameter to the plugin's AJAX trip-filtering handlers and cause the server to include and execute a file from the local filesystem. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no authentication or user interaction is required, and successful abuse can disclose sensitive data, bypass access controls, or execute pre-existing server-side PHP scripts. Exploitation is constrained in practice by the fact that inclusion is limited to .php files already resolvable on the host, so full attacker-controlled code execution additionally requires a separate means of planting a .php file; no public exploit code has been identified at time of analysis (no public exploit identified at time of analysis) and EPSS remains low at 0.80% (55th percentile), indicating elevated severity but little observed mass exploitation activity.
RemediationAI
No fixed version number is stated in the provided intelligence, so administrators should first check the plugin's changelog and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ce119965-01a0-4cff-a0b2-e99bceb1406c?source=cve, then update WP Travel Engine beyond the vulnerable 6.6.7 ceiling as soon as a patched release is published and verified; because the flaw is unauthenticated, updating is urgent for any internet-facing installation. If an immediate update is impossible, the highest-fidelity compensating control is to deactivate the WP Travel Engine plugin until a fix is applied (trade-off: all tour booking, trip listing, and AJAX trip-filtering functionality goes offline), or, for sites that must keep it live, restrict access to the plugin's AJAX actions with a WAF or reverse-proxy rule that rejects requests to wp-admin/admin-ajax.php carrying the WP Travel Engine trip-filtering action and a 'mode' parameter containing path separators, traversal sequences ('../'), or '.php' substrings (trade-off: overly broad rules can break legitimate template switching and require rule tuning to avoid false positives). Host-level hardening also materially reduces residual risk: enforce strict upload validation so no attacker-controlled .php file can be written to the webroot, disable PHP execution in the uploads directory via server configuration, and set open_basedir/disable_functions so that an included file cannot pivot further (trade-off: these are defense-in-depth measures and do not close the inclusion primitive itself). Finally, monitor web logs for anomalous admin-ajax.php requests targeting the plugin's AJAX handlers, and treat any such activity as potential reconnaissance even though no public exploit code has been identified at time of analysis.
Affected ProductsAI
The affected product is the WP Travel Engine - Tour Booking Plugin - Tour Operator Software for WordPress, all versions up to and including 6.6.7, in default configuration; the vulnerability is reachable through the plugin's AJAX entry points, so any WordPress site with the plugin active and web-exposed is in scope. The relevant code paths are the plugin's Ajax controller classes, documented in the supplied references at https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/FilterTripsHtml.php#L72 and https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/LoadTripsHtml.php#L27 (6.6.0 tags shown as the pointer to the vulnerable logic, which persists through 6.6.7). The vendor-neutral advisory and current version guidance are published by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/ce119965-01a0-4cff-a0b2-e99bceb1406c?source=cve. No CPE identifiers were included in the provided intelligence, so exact product matching for inventory tooling should be performed against the plugin slug and installed version rather than a CPE dictionary entry.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), a class of bug in which a user-supplied value reaches a PHP include/require construct without adequate validation. The plugin ships AJAX controller classes (the referenced source is includes/classes/Core/Controllers/Ajax/FilterTripsHtml.php around line 72, plus LoadTripsHtml.php around line 27) that receive a 'mode' parameter from an HTTP request and use it to select a template/partial file to include. Because the AJAX action is reachable without authentication from the WordPress admin-ajax.php endpoint (consistent with the PR:N/UI:N vector), any remote client can drive the include call. The practical ceiling on impact is that the include resolves files on the local filesystem and, per the reported behavior, is constrained to .php files; that yields disclosure or execution of already-present server-side scripts, while turning it into arbitrary attacker-supplied code execution requires an independent upload or file-write primitive capable of placing a .php file on the host. The 9.8 score reflects worst-case chaining rather than the narrowest reading of the primitive. No CPE strings were supplied with this record, so affected-product identification rests on the WordPress plugin slug (wp-travel-engine) and the stated version ceiling of 6.6.7.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote, unauthenticated, low-complexity include of local PHP (AV:N/AC:L/PR:N/UI:N); high C/I/A retained because executing included PHP can compromise the site, though full RCE is upload-dependent.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
DescriptionCVE.org
The WP Travel Engine - Tour Booking Plugin - Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Executive ViewAI
WP Travel Engine versions up to and including 6.6.7 expose WordPress sites to unauthenticated local file inclusion, putting confidential data, access controls, and booking operations at risk. Because no vendor-released patch is identified at time of analysis and the flaw requires no login or user action, organizations running affected sites should treat them as high risk and act quickly to remove or isolate the plugin. Leadership should care because successful abuse could lead to sensitive data disclosure, access-control bypass, and disruption of tour booking services.
No vendor-released patch identified at time of analysis; interim mitigations include deactivating or removing WP Travel Engine versions up to and including 6.6.7, blocking crafted mode parameters to the plugin's AJAX trip-filtering handlers via WAF or virtual patching, restricting wp-admin and AJAX endpoint access, disabling PHP execution in upload directories, applying least privilege, and monitoring for local file inclusion attempts.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Local File Inclusion vulnerabilities occur when an application accepts user-controlled input to specify which file should be loaded or executed, typically through functions like PHP's `include()`, `require()`, or `fopen()`.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
GitHub PoC
Exploit-DB