Local File Inclusion Vulnerability in WP Travel Engine Plugin for WordPress

CVE-2024-12272

Summary

The WP Travel Engine – Elementor Widgets plugin for WordPress contains a Local File Inclusion vulnerability affecting all versions prior to 1.3.8. This vulnerability allows authenticated attackers, with Contributor-level access or higher, to include and execute arbitrary files on the server. Malicious users could exploit this flaw to execute PHP code within those files, potentially bypassing security controls and gaining access to sensitive data. The vulnerability poses a serious risk, especially since it permits the inclusion of files from outside the expected file types, including images. As such, website owners utilizing this plugin should evaluate their current version and implement necessary updates to safeguard their sites against potential exploits.

References