Critical vulnerabilities reported in WP Travel Engine WordPress plugin
Take action: If you're using the WP Travel Engine plugin for WordPress, immediately update to version 6.6.8 or newer. The two flaws will be exploited very quickly, and you can't hide your WordPress from the Internet. Update the plugin, it's not that hard.
Learn More
Two critical security vulnerabilities are reported in WP Travel Engine plugin for WordPress, a travel booking plugin. Both vulnerabilities allow attackers to gain virtually complete control of affected websites.
The WP Travel Engine plugin is widely used by travel agencies and tour operators to enable website visitors to plan itineraries, browse various travel packages, and book vacation services directly through WordPress-powered websites.
Vulnerabilities summary
- CVE-2025-7634 (CVSS score 9.8) Unauthenticated Local File Inclusion vulnerability. It's caused by improper control of the mode parameter within the plugin's code, which fails to adequately validate file path inputs. Unauthenticated attackers can exploit this vulnerability to include and execute arbitrary PHP files on the server, enabling them to run malicious code, bypass access controls, and obtain sensitive data.
- CVE-2025-7526 (CVSS score 9.8): Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming vulnerability. It's caused by insufficient file path validation in the set_user_profile_image function that allows attackers to rename or delete arbitrary files anywhere on the server. By targeting critical system files such as wp-config.php, attackers can disable the website's configuration entirely, creating path for remote code execution.
Affected Versions are WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions up to and including 6.6.7
The vulnerabilities have been addressed in WP Travel Engine version 6.6.8 and all subsequent versions.
Recommendations:
Site administrators and organizations using the WP Travel Engine plugin must update to version 6.6.8 or newer immediately. Given that both vulnerabilities can be exploited without authentication, prompt updating is essential to prevent unauthorized access and potential complete compromise of affected websites. The lack of authentication requirements makes these vulnerabilities particularly dangerous, as attackers can exploit them directly without needing to obtain user credentials or elevated privileges. Website owners should prioritize this update to protect sensitive customer data, booking information, and prevent potential service disruption to their travel booking operations.
