The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion through the mode parameter that can be supplied without authentication. An attacker can force the plugin to include arbitrary PHP files, leading to the execution of any PHP code present in those files. This can bypass access controls, expose sensitive data, and grant the attacker full control of the affected WordPress site.

WordPress installations that have the WP Travel Engine – Tour Booking Plugin – Tour Operator Software package installed in versions 6.6.7 or earlier are affected. Any site that has deployed these versions of the plugin is vulnerable.

The CVSS score of 9.8 indicates a critical severity; however, the EPSS score is below 1%, suggesting a low but nonzero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers can exploit the flaw by sending crafted requests to the plugin’s Ajax endpoints that expose the mode parameter, which is unauthenticated. If the attacker can place PHP files in a writable directory, inclusion will permit arbitrary code execution.