The vulnerability allows an attacker to control the filename used in an include/require statement within the WP Travel Engine plugin, enabling Local File Inclusion (LFI). By manipulating the input, the attacker may read arbitrary files from the server, potentially exposing sensitive data or executing arbitrary PHP code if a local PHP file is included. This weakness is categorized as CWE‑98.

All WordPress sites running the WP Travel Engine plugin version 6.5.1 or earlier are affected. The issue spans the plugin’s entire version history up to and including 6.5.1.

The CVSS score of 7.5 classifies this vulnerability as high severity, suggesting significant impact if successfully exploited. However, the EPSS indicates a very low likelihood of exploitation in the wild (<1%). The vulnerability is not listed in CISA KEV, implying no confirmed public exploit at this time. The attack vector is likely local to the web server, requiring the attacker to influence the filename parameter via a crafted HTTP request. If the site allows unauthenticated users to trigger the vulnerable code, the risk escalates to remote exploitation; otherwise, authenticated users with access to the plugin’s settings may also be impacted.