PHP Remote File Inclusion Vulnerability in Mikado-Themes Backpack Traveler
CVE-2025-39490

8.1HIGH

Key Information:

Vendor

WordPress
Status
Backpack Traveler
Vendor
CVE Published:
23 May 2025

What is CVE-2025-39490?

The Mikado-Themes Backpack Traveler is susceptible to a PHP Remote File Inclusion vulnerability, allowing for local file inclusion. This issue arises when the system does not properly control the filenames provided to include or require statements in PHP scripts. Exploitation of this vulnerability can lead to unauthorized access to sensitive files on the server, potentially compromising the integrity and confidentiality of the web application.

Affected Version(s)

Backpack Traveler <= 2.7

References

https://patchstack.com/database/wordpress/theme/backpackt...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds (Patchstack Alliance)
.