CVE-2025-7526: WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the setuserprofileimage function in all versions up to, and including, 6.6.7. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7526?
CVE-2025-7526 is classified as a high severity vulnerability due to its potential for arbitrary file deletion.
How do I fix CVE-2025-7526?
To fix CVE-2025-7526, update the WP Travel Engine plugin to the latest version that addresses the file path validation issue.
What versions are affected by CVE-2025-7526?
CVE-2025-7526 affects all versions of the WP Travel Engine plugin up to and including 6.6.7.
What is the nature of the vulnerability in CVE-2025-7526?
CVE-2025-7526 allows for arbitrary file deletion through insufficient validation in the set_user_profile_image function.
Is there a workaround for CVE-2025-7526 until I can update?
A temporary workaround for CVE-2025-7526 is to disable the WP Travel Engine plugin until it can be updated.