CVE-2026-10834

Name of the Vulnerable Software and Affected Versions WP Travel Engine versions prior to 6.8.1

Description Authenticated users with subscriber-level access and above can relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This occurs because the plugin fails to properly validate the source of the user-supplied profile image path before moving the file. This action removes the targeted media from its original location, which can result in broken content across the site. The issue involves the user profile image variable.

Recommendations Update WP Travel Engine to version 6.8.1 or later.