An improper control of the filename used in a PHP include/require statement allows the WP Travel Engine plugin to include local files. An attacker who can influence the include path could read sensitive files present on the server or, in the worst case, execute arbitrary PHP code if the include target is a writable file. This vulnerability can lead to disclosure of confidential data or compromise of the host.

WP Travel Engine plugin for WordPress, version 6.3.5 or earlier. All installations of the plugin up through 6.3.5 are vulnerable.

The CVSS score of 8.1 indicates a high severity, but the EPSS score is below 1%, implying a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker could potentially trigger the flaw through a remote web request that manipulates the plugin’s include path, suggesting a remote attack vector. The ability to read or execute local files poses a significant threat to confidentiality and integrity of the affected system.