EUVD-2025-17260
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine allows PHP Local File Inclusion. This issue affects WP Travel Engine: from n/a through 6.5.1.
Analysis
PHP Local File Inclusion (LFI) vulnerability in WP Travel Engine affecting versions through 6.5.1. An authenticated attacker with low privileges can exploit improper filename control in PHP include/require statements to read arbitrary files from the server, potentially obtaining sensitive configuration data, credentials, or source code. While the CVSS score is moderate (7.5), the vulnerability requires authentication and higher attack complexity, but successful exploitation could lead to complete information disclosure and potential privilege escalation.
Technical Context
This vulnerability exploits improper input validation in PHP's include() or require() functions (CWE-98: Improper Control of Filename for Include/Require Statement in PHP). The WP Travel Engine WordPress plugin fails to properly sanitize or validate user-supplied input before passing it to file inclusion functions, allowing an attacker to traverse directory paths and include arbitrary files. The root cause is insufficient use of PHP security functions like basename(), realpath validation, or whitelisting of allowed files. Unlike Remote File Inclusion (RFI), this LFI variant is typically limited to local filesystem access unless the server is configured to allow remote stream wrappers (allow_url_include). The affected software is a WordPress plugin (identified through the WordPress ecosystem context), which runs in a typical LAMP/LEMP environment with PHP execution.
Affected Products
WP Travel Engine (through 6.5.1)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today