Introduction
Attackers can get remote code execution on WordPress sites running WP Travel Engine through a local file inclusion flaw in the plugin's AJAX endpoints. No authentication is needed, and every plugin version up to and including 6.6.7 is affected. That puts over 20,000 travel and tour operator websites at risk of compromise.
WP Travel Engine is a leading WordPress plugin for travel agencies and tour operators. It runs booking and itinerary management for a significant portion of the online tourism sector. Because the plugin is so widely adopted and handles sensitive customer data, a vulnerability in it matters more than most, for site owners and their clients alike.
Technical information
CVE-2025-7634 is a local file inclusion vulnerability in the WP Travel Engine plugin for WordPress. The flaw is in how the plugin's AJAX endpoints handle the mode parameter, in these controller files:
includes/classes/Core/Controllers/Ajax/FilterTripsHtml.phpat line 72includes/classes/Core/Controllers/Ajax/LoadTripsHtml.phpat line 27
The plugin uses input from the mode parameter directly to decide which file to include, without sufficient validation or sanitization. An attacker can therefore supply an arbitrary file path and have the server include and execute any PHP file the web server can access. If attackers can upload a PHP file to the server through another vector, they can use this flaw to run their code and take full control of the site.
The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). Because the attack needs no authentication, automated tools can exploit it at scale. Exploitation can bypass access controls, disclose sensitive information, and lead to remote code execution.
The vulnerable code can be viewed in public repositories:
Affected systems and versions
- Product: WP Travel Engine WordPress plugin
- Affected versions: All versions up to and including 6.6.7
- Only WordPress sites with this plugin enabled are vulnerable
Vendor security history
WP Travel Engine has had multiple critical vulnerabilities in recent versions:
- CVE-2025-5282: Missing authorization in delete package functionality (up to 6.5.1)
- Earlier local file inclusion issues in older versions
- Most security disclosures have come from external researchers such as Wordfence and Patchstack
- The vendor provides updates, but changelog transparency is limited
