PT-2025-24236 · WordPress · Wp Travel Engine

Name of the Vulnerable Software and Affected Versions: WP Travel Engine versions through 6.5.1 Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This allows PHP Local File Inclusion...

CVE-2025-30871

CVE-2025-30871 is a WordPress vulnerability in the WP Travel Engine plugin caused by improper control of filenames for include/require statements , enabling unauthenticated access to a PHP Local File Inclusion (LFI). Affected versions: WP Travel Engine

CVE-2024-32798

CVE-2024-32798 is a Missing Authorization vulnerability in the WordPress plugin WP Travel Engine, affecting WP Travel Engine versions from n/a up to and including 5.8.0. The connected enrichment and Red Hat/WordPress records reference a price manipulation impact associated with this vulnerability...