PT-2025-41358 · WordPress · Wp Travel Engine – Tour Booking Plugin – Tour Operator

Wesley · Published 2025-10-09 · Updated 2025-10-09 · CVE-2025-7634

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.6.8

Description The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is susceptible to a Local File Inclusion issue in versions up to and including 6.6.7. This allows unauthenticated attackers to include and execute arbitrary .php files on the server through the mode parameter. Successful exploitation could allow attackers to bypass access controls, obtain sensitive data, or execute PHP code if .php file uploads are permitted.

Recommendations Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to version 6.6.8 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-7634

Affected Products

Wp Travel Engine – Tour Booking Plugin – Tour Operator

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-7634 · Security Note
• https://t.me/CVEtracker/34508 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1976181424236487107 · Twitter Post
• https://twitter.com/CVEnew/status/1976163383742189956 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ce119965-01a0-4cff-a0b2-e99bceb1406c?source=cve · Note
• https://twitter.com/0dayPublishing/status/1976319027053003094 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/LoadTripsHtml.php#L27 · Note
• https://twitter.com/VulmonFeeds/status/1976230974271717704 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/FilterTripsHtml.php#L72 · Note