WP Travel Engine plugin up to version 6.3.5 contains an improper control of filename for the include/require statement in its PHP code, allowing an attacker to trigger local file inclusion. This can lead to execution of arbitrary PHP code if the attacker can supply a path to a vulnerable file or read sensitive files, which is identified as CWE-98.

The vulnerability affects installations of the WP Travel Engine WordPress plugin with versions up to and including 6.3.5. Any WordPress site that has not yet upgraded beyond this version is potentially impacted.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of less than 1% suggests exploitation likelihood is currently low. As the issue is not listed in the CISA KEV catalog, no known widespread exploitation has been reported yet. The typical attack vector would be through a crafted web request that manipulates the plugin’s filename handling to include a local file.