CVE-2025-7634: WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7634?
CVE-2025-7634 has a high severity rating due to its potential for local file inclusion, allowing unauthenticated attackers to execute arbitrary code.
How do I fix CVE-2025-7634?
To fix CVE-2025-7634, update the WP Travel Engine plugin to version 6.6.8 or later.
What versions are affected by CVE-2025-7634?
CVE-2025-7634 affects all versions of the WP Travel Engine plugin up to and including version 6.6.7.
Who is impacted by CVE-2025-7634?
Any WordPress site using the WP Travel Engine plugin versions 6.6.7 and below is impacted by CVE-2025-7634.
What kind of attack can be executed using CVE-2025-7634?
CVE-2025-7634 allows attackers to perform local file inclusion, enabling them to include and execute arbitrary PHP files.