CVE-2025-30870
CVSS 3.1 Score 8.1 of 10 (high)
Details
Published Apr 1, 2025
CWE ID 98
Summary
CVE-2025-30870 is a filename manipulation vulnerability affecting WP Travel Engine, a plugin used for managing travel booking sites. This issue permits PHP Local File Inclusion, enabling an attacker to access sensitive files on the affected system by exploiting the flaw in WP Travel Engine, which is vulnerable from version n/a up to 6.3.5. This vulnerability poses a threat if an attacker can include malicious files, potentially leading to data theft or server takeover.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- WP Travel Engine Plugin
Affected Vendors
- WordPress