Introduction
Attackers can delete critical files on any WordPress site running a vulnerable version of WP Travel Engine, which can lead to full site takeover and remote code execution. The plugin has over 10,000 active installations, so the issue directly affects travel operators and booking platforms worldwide.
WP Travel Engine is a WordPress plugin built for tour operators and travel agencies. It runs booking and itinerary management for thousands of travel industry websites. Because so much of the tourism sector uses it, a vulnerability in the plugin can quickly affect both day-to-day operations and data security across many sites.
Technical Information
CVE-2025-7526 is an arbitrary file deletion vulnerability in the WP Travel Engine plugin for WordPress. The flaw is in the set_user_profile_image function in includes/dashboard/class-wp-travel-engine-form-handler.php (see source). The function handles user profile image uploads and management. In all versions up to and including 6.6.7, it does not properly validate the file path the user supplies.
The root cause is insufficient sanitization of user-supplied file paths. An attacker can pass path traversal sequences such as ../ to escape the intended directory and reach arbitrary files elsewhere on the server. The vulnerable function performs a file rename, and that rename can be abused to delete files outside the intended upload directory. This is a classic CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) vulnerability (CWE-22).
If an attacker deletes wp-config.php, WordPress shows the installation wizard on the next visit. The attacker can then reconfigure the site with their own credentials and take full administrative access. Other possible targets include .htaccess and plugin files, and deleting them weakens the site's security further.
The vulnerability is exploitable without authentication. An attacker only needs to send crafted HTTP requests with malicious file path parameters to the affected endpoint, which makes the issue easy to exploit at scale.
Affected Systems and Versions
- WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress
- All versions up to and including 6.6.7
- No authentication required for exploitation
- All configurations using the vulnerable plugin versions are affected
Vendor Security History
WP Travel Engine has had multiple critical vulnerabilities in recent years, including:
- CVE-2025-30871: Local File Inclusion in versions up to 6.3.5 (details, Wordfence advisory)
- Access control and file handling issues reported in other security advisories
The repeated issues point to ongoing problems with secure coding and input validation in the plugin's development lifecycle.
