A high-severity local file inclusion vulnerability in the WP Travel Engine plugin for WordPress allows authenticated attackers to execute arbitrary PHP code on the host server.

This is a local file inclusion (CWE-98) flaw within the wte_get_template function. Authenticated users with contributor-level access or higher can manipulate this function to include and execute arbitrary PHP files located on the server.

Successful exploitation permits an attacker to achieve remote code execution, which can lead to complete site compromise, unauthorized database access, and data exfiltration. Given the CVSS score of 7.5, this vulnerability represents a significant risk to the integrity and availability of the WordPress environment, especially for sites that allow user contributions.

Immediate Action: Update the WP Travel Engine plugin to version 6.8.1 or later, as identified in the vendor changeset.

Proactive Monitoring: Audit WordPress user accounts to ensure only trusted individuals hold contributor-level permissions or higher, and monitor server logs for unusual file inclusion patterns or unexpected PHP execution requests.

Compensating Controls: Implement a Web Application Firewall (WAF) to block requests containing directory traversal sequences or suspicious path injection attempts directed at the affected plugin endpoints.

Public Exploit Available: No (exploit_available unknown).

This vulnerability poses a substantial risk to server security due to the potential for arbitrary code execution. Administrators should prioritize updating the WP Travel Engine plugin to the latest patched version immediately to eliminate the underlying flaw and prevent unauthorized access by privileged users.