The WP Travel Engine – Tour Booking Plugin for WordPress contains a flaw in the set_user_profile_image routine that fails to properly validate the requested file path. This oversight allows an attacker to rename a target file to itself, effectively deleting it. By removing critical files such as wp-config.php an attacker can gain a foothold that results in remote code execution. The weakness is classified as CWE‑22, a path traversal vulnerability that compromises file system integrity.

Any WordPress installation that has the WP Travel Engine plugin version 6.6.7 or earlier is affected. It is inferred that sites using the plugin for tour booking are exposed if the set_user_profile_image endpoint is reachable by users who should not have that capability.

The CVSS score of 9.8 places the flaw in the critical severity range. The EPSS score of less than 1 % indicates a low probability of large‑scale exploitation at the present time, and the vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack can be performed via an unauthenticated HTTP request to the plugin’s set_user_profile_image handler. If the attacker supplies a filename that includes directory traversal sequences or an absolute path, the web process can delete any file it can write, enabling remote code execution if a crucial file is removed. While the exploit path is narrow, the potential impact is severe, making the risk high for each affected host but moderate overall due to the low likelihood of exploitation.