CVE-2025-30870
📋 TL;DR
This vulnerability allows attackers to include local files on the server through improper filename control in PHP include/require statements. It affects all WordPress sites using WP Travel Engine plugin versions up to 6.3.5, potentially leading to sensitive information disclosure or remote code execution.
💻 Affected Systems
- WP Travel Engine WordPress Plugin
📦 What is this software?
Wp Travel Engine by Wptravelengine
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise via Local File Inclusion leading to Remote Code Execution, allowing attackers to execute arbitrary code, steal sensitive data, or take over the entire WordPress installation.
Likely Case
Information disclosure of sensitive server files (configuration files, password hashes, environment variables) and potential privilege escalation within the WordPress environment.
If Mitigated
Limited impact with proper file permissions and web server configurations that restrict PHP execution in sensitive directories.
🎯 Exploit Status
Exploitation requires no authentication and uses simple HTTP requests. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.6 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find WP Travel Engine
4. Click 'Update Now' if update is available
5. Alternatively, download version 6.3.6+ from WordPress repository and manually update
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable WP Travel Engine plugin until patched
wp plugin deactivate wp-travel-engine
Restrict PHP file inclusion
allAdd web server rules to restrict file inclusion patterns
# For Apache: Add to .htaccess
<FilesMatch "\.(php|inc)$">
Order Deny,Allow
Deny from all
</FilesMatch>
# For Nginx: Add to server block
location ~ \.(php|inc)$ {
deny all;
}
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block file inclusion patterns
- Restrict file system permissions and disable dangerous PHP functions like include, require
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → WP Travel Engine version. If version is 6.3.5 or lower, system is vulnerable.Check Version:
wp plugin get wp-travel-engine --field=versionVerify Fix Applied:
Verify WP Travel Engine plugin version is 6.3.6 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual file paths in PHP error logs
- Multiple requests to wp-travel-engine with file inclusion parameters
- HTTP 200 responses to requests with ../ patterns
Network Indicators:
- HTTP GET requests containing file inclusion patterns (../, /etc/passwd, etc.) to wp-travel-engine endpoints
SIEM Query:
source="web_logs" AND (uri="*wp-travel-engine*" AND (uri="*../*" OR uri="*/etc/*" OR uri="*php://*"))