What is the CVSS score of EUVD-2025-17260?

EUVD-2025-17260 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by EUVD-2025-17260?

WP Travel Engine versions up to 6.5.1 contain a critical file inclusion vulnerability that could allow attackers to access sensitive files on affected servers.

How to fix or mitigate EUVD-2025-17260?

Within 24 hours: Audit all systems running WP Travel Engine to identify affected versions and document exposure scope. Within 7 days: Implement Web Application Firewall (WAF) rules blocking suspicious file inclusion patterns targeting the vulnerable component, and restrict direct access to the plugin's vulnerable endpoints if possible. Within 30 days: Either upgrade to a patched version once available, replace WP Travel Engine with an alternative solution, or completely disable the plugin if non-critical to operations.

PHP EUVD-2025-17260

| CVE-2025-49308 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-06 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17260

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine allows PHP Local File Inclusion. This issue affects WP Travel Engine: from n/a through 6.5.1.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in WP Travel Engine affecting versions through 6.5.1. An authenticated attacker with low privileges can exploit improper filename control in PHP include/require statements to read arbitrary files from the server, potentially obtaining sensitive configuration data, credentials, or source code. While the CVSS score is moderate (7.5), the vulnerability requires authentication and higher attack complexity, but successful exploitation could lead to complete information disclosure and potential privilege escalation.

Technical ContextAI

This vulnerability exploits improper input validation in PHP's include() or require() functions (CWE-98: Improper Control of Filename for Include/Require Statement in PHP). The WP Travel Engine WordPress plugin fails to properly sanitize or validate user-supplied input before passing it to file inclusion functions, allowing an attacker to traverse directory paths and include arbitrary files. The root cause is insufficient use of PHP security functions like basename(), realpath validation, or whitelisting of allowed files. Unlike Remote File Inclusion (RFI), this LFI variant is typically limited to local filesystem access unless the server is configured to allow remote stream wrappers (allow_url_include). The affected software is a WordPress plugin (identified through the WordPress ecosystem context), which runs in a typical LAMP/LEMP environment with PHP execution.