EUVD-2026-42010
GHSA-qj2j-73pj-4fxf
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
PR:L confirmed by subscriber-level requirement; UI:N because the attacker acts alone with no victim interaction needed; C:N as file contents are not disclosed.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
3DescriptionCVE.org
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.
AnalysisAI
WP Travel Engine WordPress plugin before 6.8.1 allows any subscriber-level authenticated user to relocate arbitrary files within the WordPress uploads directory by supplying a crafted source path during a profile image update, effectively removing targeted media from its original location and breaking dependent site content. A proof-of-concept has been confirmed via the SSVC exploitation field, though the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity in the wild. No CISA KEV listing exists, and the real-world impact is bounded to sites that permit subscriber-level user accounts with profile editing capability.
Technical ContextAI
WP Travel Engine is a WordPress plugin purpose-built for travel booking, tour listings, and itinerary management - deployments typically expose subscriber-level accounts to registered travelers or customers. The vulnerable component is the profile image update handler, which accepts a user-controlled source file path and passes it directly to a file-move operation without verifying that the path is associated with the requesting user or was produced by a legitimate prior upload step. This constitutes a failure of path origin validation within the WordPress uploads directory tree. Although no CWE is formally assigned in the input data, the root cause aligns with CWE-73 (External Control of File Name or Path) - the user controls the 'from' operand of a server-side move, not just the filename. The scope of traversal is constrained to the uploads directory; no evidence suggests arbitrary filesystem reach beyond that boundary. Affected versions span all releases from initial distribution through 6.8.0 inclusive per EUVD-2026-42010.
RemediationAI
Update WP Travel Engine to version 6.8.1 or later, which contains the vendor-released patch. The update can be applied directly from the WordPress admin dashboard under Plugins > Installed Plugins > WP Travel Engine > Update, or via WP-CLI using 'wp plugin update wp-travel-engine'. Advisory references include WPScan (https://wpscan.com/vulnerability/5b939f98-0fbd-4f89-9948-77dbcc67f9d3/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-10834). If immediate patching is not possible, disable open user registration in WordPress Settings > General to remove the subscriber account creation surface - note this will prevent new customer self-registration on travel booking portals. Alternatively, use a role-management plugin to revoke profile image editing capability from subscriber accounts specifically; the trade-off is reduced self-service functionality for registered travelers.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today