Local File Inclusion Vulnerability in WP Travel Engine Plugin for WordPress
CVE-2025-7634
9.8CRITICAL
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 October 2025
What is CVE-2025-7634?
The WP Travel Engine plugin for WordPress is susceptible to a Local File Inclusion vulnerability due to improper handling of the 'mode' parameter in all versions up to and including 6.6.7. This flaw enables unauthorized attackers to include and execute arbitrary .php files on the server. If exploited, this vulnerability could lead to the execution of any code within those .php files, facilitating access control bypass, sensitive data exposure, or even full server compromise.
Affected Version(s)
WP Travel Engine – Tour Booking Plugin – Tour Operator Software * <= 6.6.7