The Traveler WordPress theme is vulnerable in versions up to 3.1.8 to a Local File Inclusion flaw triggered by the 'style' parameter in the hotel_alone_load_more_post function. An unauthenticated attacker can cause the theme to include and execute arbitrary files on the server, enabling them to run any PHP code. This can lead to bypassing access controls, exfiltrating sensitive data, or establishing persistent remote code execution if PHP files can be uploaded or accessed locally.

All installations of the ShineTheme Travel Booking WordPress Theme running a version 3.1.8 or earlier are impacted. The vulnerability applies to the function available publicly via the WordPress site.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of 1% shows that exploitation is likely given the high impact. The exploit does not currently appear in the CISA KEV catalog. Attackers can trigger the flaw through a simple unauthenticated web request to the vulnerable function, so the attack vector is remote network access to the affected site.