CVE-2025-7634

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.6.8

Description The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is susceptible to a Local File Inclusion issue in versions up to and including 6.6.7. This allows unauthenticated attackers to include and execute arbitrary .php files on the server through the mode parameter. Successful exploitation could allow attackers to bypass access controls, obtain sensitive data, or execute PHP code if .php file uploads are permitted.

Recommendations Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to version 6.6.8 or later.