Local File Inclusion Vulnerability in Traveler Theme by WordPress

CVE-2025-1771

What is CVE-2025-1771?

The Traveler theme for WordPress possesses a Local File Inclusion vulnerability that affects all versions up to and including 3.1.8. The vulnerability arises through the 'hotel_alone_load_more_post' function's 'style' parameter, allowing unauthenticated attackers to include and execute arbitrary files on the server. This flaw exposes critical security risks as it can enable attackers to bypass access controls, retrieve sensitive data, or execute malicious PHP code. Given this potential for exploitation, users of the Traveler theme are urged to update to secure versions promptly.

References