Is CVE-2026-10834 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10834 being exploited in the wild.

How severe is CVE-2026-10834?

Informational severity, with a CVSS score of 6.5, published 7 July 2026.

Is there a fix for CVE-2026-10834?

A patch was published on 2026-06-16: Fix released in version 6.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10834 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-10834?

Check whether you run WP Travel Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10834: WP Travel Engine arbitrary file move via user_profile_image

CVE-2026-10834 · Severity: info · CVSS 6.5 · Published 2026-07-07

A vulnerability in the WP Travel Engine plugin for WordPress allows logged-in users, even those with low-level 'subscriber' permissions, to move and rename media files on the website. By manipulating their profile settings, an attacker can relocate images or documents from the site's central library to their own profile folder. This action effectively deletes the original file from its intended location, which can break website content, disrupt operations, and cause data loss for other users.

Technologies: WP Travel Engine. Vendors: WP Travel Engine.

Quick answers

Is CVE-2026-10834 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10834 being exploited in the wild.
How severe is CVE-2026-10834?: Informational severity, with a CVSS score of 6.5, published 7 July 2026.
Which products and versions are affected?: WP Travel Engine < 6.8.1.
Is there a fix for CVE-2026-10834?: A patch was published on 2026-06-16: Fix released in version 6.8.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10834 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-10834?: Check whether you run WP Travel Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The WP Travel Engine plugin for WordPress fails to properly validate the source path of a user-supplied profile image before performing a file move operation. Specifically, the 'user_profile_image' parameter in the 'wp_travel_engine_save_account_details' action can be manipulated to point to an absolute server path of any file within the WordPress uploads directory. An authenticated attacker with Subscriber-level privileges can exploit this to move existing media files into their own profile image directory. Because the operation is a 'move' rather than a 'copy', the original file is deleted from its source location, leading to a loss of integrity and availability for site assets. This is classified as an External Control of File Name or Path (CWE-73). The issue is fixed in version 6.8.1.

Affected products

WP Travel Engine WP Travel Engine < 6.8.1

Timeline

2026-06-16: disclosed: Initial public disclosure by WPScan
2026-06-16: patched: Fix released in version 6.8.1
2026-07-07: advisory: NVD publication date

References

https://wpscan.com/vulnerability/5b939f98-0fbd-4f89-9948-77dbcc67f9d3/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.