CVE-2025-39490: WordPress Backpack Traveler theme <= 2.10.2 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows PHP Local File Inclusion.This issue affects Backpack Traveler: from n/a through <= 2.10.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39490?
CVE-2025-39490 is classified as a high severity vulnerability due to its potential for exploitation through Local File Inclusion.
How do I fix CVE-2025-39490?
To fix CVE-2025-39490, update Mikado-Themes Backpack Traveler to version 2.8 or later.
What types of attacks can CVE-2025-39490 facilitate?
CVE-2025-39490 can facilitate attacks such as Local File Inclusion, allowing an attacker to execute arbitrary files on the server.
Which versions of Backpack Traveler are affected by CVE-2025-39490?
CVE-2025-39490 affects Backpack Traveler versions up to and including 2.7.
Who issued the CVE for this vulnerability?
CVE-2025-39490 was registered with the MITRE Corporation, the organization responsible for maintaining the CVE database.