Description

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-22T09:17:06.353Z",
  "pubdate": "2026-09-22T09:17:06.353Z",
  "executiveSummary": "The WP Travel Engine plugin for WordPress is susceptible to a Local File Inclusion (LFI) vulnerability that allows authenticated users to execute arbitrary PHP code on the host server.\nThe flaw resides within the wte_get_template function, which fails to properly sanitize user-supplied input before using it to include files.\nThe vulnerability affects all versions of the WP Travel Engine plugin up to and including 6.8.0.\nExploitation requires a user to hold at least contributor-level privileges. Successful execution of this vulnerability allows an attacker to bypass security restrictions, access sensitive server-side data, or achieve Remote Code Execution (RCE) if the attacker can place a malicious PHP file on the server (e.g., via a separate file upload vector).\nGiven the ability to execute arbitrary code, the risk implication is critical, as it may lead to a complete compromise of the WordPress installation and the underlying server environment.",
  "technicalDetails": "The vulnerability is localized within the wte_get_template function of the WP Travel Engine plugin. This function is designed to handle template loading but performs insufficient validation on the input parameters passed to it.\nBy manipulating the parameters utilized by wte_get_template, an attacker can influence the file path passed to PHP's file inclusion primitives (such as include() or require()). Because the input is not strictly constrained to expected template directories or file extensions, the application can be coerced into including unintended local files.\nThe exploit flow begins with an authenticated attacker, possessing a minimum of contributor-level access, crafting a request that targets the wte_get_template function. By injecting path traversal sequences or pointing the input toward an existing, attacker-controlled file on the server, the attacker can force the web server to execute the contents of that file as PHP code.\nIn scenarios where the target server allows for file uploads—or where the attacker can leverage other site features to create a file containing PHP code—the LFI vector serves as a direct execution trigger. Once the included file is processed by the PHP interpreter, the injected code runs with the permissions of the web server user.\nThis behavior facilitates a wide range of post-exploitation activities, including but not limited to, unauthorized access to the WordPress database, exfiltration of configuration files containing credentials, modification of core application files, or the establishment of a web shell for persistent access.\nThe vulnerability effectively breaks the intended isolation between template rendering and server-side file system operations, transforming a template-loading mechanism into a critical arbitrary code execution primitive."
}