Executive brief
WP Travel Engine is a WordPress plugin for tour booking and operator management. The plugin contains a local file inclusion vulnerability in its template loading function that allows authenticated users with contributor-level access to include and execute arbitrary PHP files, potentially leading to complete site compromise or data theft.
Technical details
The wte_get_template function in WP Travel Engine fails to properly validate file paths, allowing authenticated attackers with contributor privileges to include arbitrary .php files via local file inclusion. By combining this with the ability to upload PHP files, an attacker can achieve arbitrary code execution on the server with PHP interpreter privileges.
Affected products
- ThemeGrill WP Travel Engine up to and including 6.8.0
Timeline
- 2026-09-22: disclosed