CVE-2025-30871
📋 TL;DR
This vulnerability allows attackers to include local files on the server through improper input validation in WP Travel Engine WordPress plugin. Attackers can potentially read sensitive files or execute code by manipulating file inclusion parameters. All WordPress sites using WP Travel Engine versions up to 6.3.5 are affected.
💻 Affected Systems
- WP Travel Engine WordPress Plugin
📦 What is this software?
Wp Travel Engine by Wptravelengine
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, and website defacement.
Likely Case
Local file inclusion allowing reading of sensitive configuration files (wp-config.php) and potential information disclosure.
If Mitigated
Limited impact with proper file permissions and web application firewall rules blocking suspicious file inclusion attempts.
🎯 Exploit Status
Exploitation requires understanding of PHP file inclusion vulnerabilities and WordPress plugin structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.3.6 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Travel Engine and click 'Update Now'. 4. Verify version is 6.3.6 or higher.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests containing suspicious file inclusion patterns in parameters
Disable Plugin
WordPressTemporarily disable WP Travel Engine plugin until patched
wp plugin deactivate wp-travel-engine
🧯 If You Can't Patch
- Implement strict file permissions (644 for files, 755 for directories)
- Deploy web application firewall with LFI protection rules
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > WP Travel Engine versionCheck Version:
wp plugin get wp-travel-engine --field=versionVerify Fix Applied:
Confirm WP Travel Engine version is 6.3.6 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual file paths in GET/POST parameters
- Multiple 404 errors for non-existent plugin files
- Access to sensitive files like wp-config.php
Network Indicators:
- HTTP requests with file path traversal patterns in parameters
- Requests to plugin endpoints with suspicious include parameters
SIEM Query:
source="web_logs" AND (uri="*wp-travel-engine*" AND (param="*../*" OR param="*/etc/*" OR param="*wp-config*"))