CVE-2025-30871

Summary

CVE-2025-30871 is a filename manipulation vulnerability affecting WP Travel Engine, a popular travel booking plugin for WordPress. The issue stems from the plugin's improper handling of include/require statements, enabling an attacker to include arbitrary local files on a vulnerable system. This can potentially lead to unauthorized system access, data theft, or other malicious activities. WP Travel Engine versions from n/a to 6.3.5 are vulnerable to this PHP Local File Inclusion (LFI) vulnerability. Users are strongly advised to update to the latest version or consider alternative solutions to mitigate the risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.