WP Travel Engine Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the WP Travel Engine WordPress plugin, affecting versions through 6.3.5. This vulnerability allows improper control of filenames in include or require statements, which could be exploited to include local files from the server and execute them, potentially leading to the disclosure of sensitive information such as database credentials.

Impact

Exploitation of this vulnerability could allow a malicious actor to include and execute local files on the server, with the possibility of accessing sensitive information like database credentials. Depending on the server configuration, this could lead to a complete takeover of the database.

Remediation

Users of the WP Travel Engine plugin should update to version 6.3.6 or later. Patchstack users can enable auto-update for vulnerable plugins.