The vulnerability arises from the wte_get_template function within the WP Travel Engine plugin, which accepts a user‑supplied 'template' shortcode attribute without proper validation. This flaw allows an authenticated contributor or higher user to include any existing .php file on the server, facilitating the execution of arbitrary PHP code. The impact is full code execution, potential data exfiltration, and escalation of privileges if the attacker can place malicious files within the web root or upload them through other plugin interfaces.

All versions of the WP Travel Engine – Tour Booking Plugin up to and including 6.8.0 are affected. The vendor product is WordPress plugin “WP Travel Engine” provided by wptravelengine. No specific sub‑versions are listed beyond the comparison to 6.8.1, which contains the fix.

The CVSS score of 7.5 indicates a high severity with potential for serious compromise. While the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the flaw demands only authenticated access from a contributor level or higher, a role that many site administrators might assign. Once authenticated, an attacker can include arbitrary files, enabling remote code execution if PHP files can be uploaded or if the attacker can influence the request to reference a sensitive file. The lack of public exploitation evidence does not diminish the risk, as the local file inclusion can be leveraged for further attacks such as privilege escalation or data theft once code execution is achieved.