PHP Remote File Inclusion Vulnerability in WP Travel Gutenberg Blocks by WordPress
CVE-2025-53207

8.1HIGH

Key Information:

Vendor

WordPress
Status
WP Travel Gutenberg Blocks
Vendor
CVE Published:
20 August 2025

What is CVE-2025-53207?

The improper control of filename handling within the WP Travel Gutenberg Blocks plugin exposes it to a PHP local file inclusion vulnerability. This flaw allows an attacker to manipulate the way files are included, potentially enabling unauthorized access to sensitive files on the server. Affected versions are up to 3.9.0, underscoring the need for prompt updates to mitigate the risks associated with this security issue.

Affected Version(s)

WP Travel Gutenberg Blocks <= 3.9.0

References

https://patchstack.com/database/wordpress/plugin/wp-trave...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
.