Executive brief
WP Travel Engine is a popular WordPress plugin used by travel agencies to manage tour bookings and itineraries. A critical security flaw allows unauthenticated attackers to inject malicious data into the website's backend. If successfully exploited, this could lead to full site takeover, data theft, or the complete disruption of booking services.
Technical details
The WP Travel Engine plugin for WordPress is vulnerable to PHP Object Injection in versions up to 6.7.12 due to improper deserialization of untrusted user input (CWE-502). An unauthenticated remote attacker can exploit this by sending a specially crafted request containing a malicious PHP object. If a suitable Property-Oriented Programming (POP) chain is present in the environment, the attacker can achieve remote code execution, perform SQL injection, or access sensitive files via path traversal. The vulnerability is resolved in version 6.8.0.
Affected products
- WP Travel Engine WP Travel Engine <= 6.7.12
Timeline
- 2026-01-15: other: Vulnerability reported by researcher daroo
- 2026-06-04: patched: Version 6.8.0 released to address the issue
- 2026-06-15: disclosed: CVE published to NVD