WP Travel Engine EUVD-2026-84333

Requires an authenticated WordPress account with contributor-level capability or higher (PR:L) on a site running WP Travel Engine ≤6.8.0; the LFI is triggered through the wte_get_template helper reached via a plugin shortcode. Full remote code execution is further gated on the attacker's ability to place an attacker-controlled .php file on the server that can then be included - the description states this explicitly ('in cases where .php file types can be uploaded and included'), which is why CVSS assigns AC:H. Without that upload primitive, exploitation is limited to including/executing pre-existing server-side .php and disclosing sensitive data. Limiting factors: needs valid low-privilege authentication (not fully anonymous), high attack complexity, and the plugin must be installed and its shortcode reachable.

This is a genuinely serious but conditionally-gated vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) tells a nuanced story: network-reachable but with high attack complexity (AC:H) and requiring low-level authentication (PR:L, i.e. contributor-level). The full C:H/I:H/A:H triple reflects the worst-case outcome - arbitrary PHP execution - but the description explicitly conditions RCE on 'cases where .php file types can be uploaded and included,' which is what drives the AC:H rating: an attacker must first get attacker-controlled PHP onto the server before the LFI becomes true code execution. Without that, the primary realizable impact is inclusion/execution of existing server-side .php files and information disclosure. No EPSS score, no CISA KEV listing, and no public exploit code were provided, so there is currently no signal of active or automated exploitation - no public exploit identified at time of analysis. The realistic priority is elevated for sites that allow contributor self-registration or have multiple low-trust authors, and lower for tightly-controlled single-author sites. Net: a real, patch-worthy issue (fixed in 6.8.1) but not a drop-everything emergency absent exploitation signals.

An attacker registers or obtains a contributor-level account on a WordPress site running WP Travel Engine ≤6.8.0, then abuses the wte_get_template function (reachable via a plugin shortcode) to force inclusion of a server-side .php path. If the attacker can also place a .php file on the server (e.g. via a permissive media/upload path), the included file executes as PHP, yielding code execution; otherwise they leverage the inclusion to read sensitive files or bypass access controls. No public proof-of-concept exploit was provided in the intelligence, and the high attack complexity reflects the extra step of getting includable PHP onto the host.