WP Travel Engine Local File Inclusion Vulnerability

A local file inclusion vulnerability has been identified in the WP Travel Engine WordPress plugin, affecting versions through 6.3.5. This vulnerability allows improper control of filenames in include or require statements, which could be exploited to include local files from the target website and display their contents. Files containing sensitive information, such as database credentials, could potentially be accessed and misused, depending on the site's configuration.

Impact

Exploitation of this vulnerability could lead to unauthorized access to local files on the server, including sensitive information such as database credentials, which could allow for a complete takeover of the database, depending on the configuration.

Remediation

Users of the WP Travel Engine plugin should update to version 6.3.6 or later to address this vulnerability. Patchstack users can enable auto-update for vulnerable plugins.