CVE-2025-30870: WP Travel Engine Path Traversal Flaw

CVE-2025-30870 Overview

CVE-2025-30870 is a PHP Local File Inclusion (LFI) vulnerability affecting WP Travel Engine, a popular WordPress plugin used for creating travel booking websites. The vulnerability stems from improper control of filename for include/require statements in PHP, allowing attackers to include arbitrary local files on the server. This weakness can be exploited to read sensitive configuration files, execute malicious PHP code, or potentially escalate to remote code execution under certain server configurations.

Critical Impact

Unauthenticated attackers can exploit this LFI vulnerability to read sensitive files, potentially exposing database credentials, API keys, and other confidential data. Under specific conditions, this could lead to full site compromise.

Affected Products

• WP Travel Engine plugin for WordPress versions through 6.3.5
• WordPress sites using affected WP Travel Engine versions
• Travel booking websites built with vulnerable plugin installations

Discovery Timeline

• 2025-04-01 - CVE-2025-30870 published to NVD
• 2025-05-27 - Last updated in NVD database

Technical Details for CVE-2025-30870

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and CWE-706 (Use of Incorrectly-Resolved Name or Reference). The flaw exists in how the WP Travel Engine plugin processes user-supplied input when constructing file paths for PHP include or require statements.

When a PHP application uses dynamic file inclusion without proper validation, an attacker can manipulate the file path to include unintended files from the local filesystem. In the context of WordPress, this is particularly dangerous as attackers can potentially include files like wp-config.php to extract database credentials, or include log files that may contain injected PHP code.

The vulnerability is accessible over the network without requiring authentication or user interaction, making it highly exploitable in automated attack scenarios.

Root Cause

The root cause lies in insufficient input validation and sanitization when handling filename parameters used in PHP include or require statements. The plugin fails to properly validate and restrict which files can be included, allowing directory traversal sequences (e.g., ../) or absolute paths to be processed. Without proper whitelisting of allowed files or directories, attackers can navigate outside the intended directory scope and access sensitive system files.

Attack Vector

The attack can be executed remotely over the network against any WordPress site running a vulnerable version of WP Travel Engine. An attacker does not need any authentication credentials or special privileges to exploit this vulnerability. The attack typically involves crafting malicious HTTP requests containing path traversal sequences or manipulated file paths targeting the vulnerable include functionality.

Successful exploitation could allow an attacker to:

• Read sensitive configuration files containing database credentials
• Access WordPress secret keys and salts
• Include PHP files to execute arbitrary code (if combined with file upload capabilities)
• Extract user data and session information
• Potentially achieve full server compromise through log poisoning techniques

For detailed technical information about this vulnerability, refer to the Patchstack security advisory.

Detection Methods for CVE-2025-30870

Indicators of Compromise

• Unusual HTTP requests containing directory traversal sequences (../, ..%2F, %2e%2e/) targeting WP Travel Engine endpoints
• Web server access logs showing requests attempting to access sensitive files like wp-config.php, /etc/passwd, or log files
• Unexpected file access patterns in PHP error logs indicating failed file inclusion attempts
• Signs of credential theft or unauthorized database access following successful exploitation

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts targeting WordPress plugins
• Monitor web server logs for anomalous requests containing encoded traversal sequences or attempts to include files outside the plugin directory
• Deploy intrusion detection systems with signatures for LFI attack patterns specific to WordPress environments
• Use file integrity monitoring on critical WordPress configuration files to detect unauthorized access

Monitoring Recommendations

• Enable detailed access logging on web servers to capture full request URIs and parameters
• Configure alerts for repeated 4xx or 5xx errors that may indicate exploitation attempts
• Monitor for unusual outbound connections that could indicate data exfiltration following successful exploitation
• Implement real-time log analysis to detect patterns consistent with automated scanning tools targeting this vulnerability

How to Mitigate CVE-2025-30870

Immediate Actions Required

• Update WP Travel Engine plugin to a version newer than 6.3.5 immediately
• Audit web server logs for any signs of exploitation attempts prior to patching
• Review and rotate database credentials if compromise is suspected
• Implement WAF rules to block path traversal attempts as a temporary measure while patching

Patch Information

The vulnerability affects WP Travel Engine versions through 6.3.5. Website administrators should update to the latest available version through the WordPress plugin repository. After updating, verify the plugin version in the WordPress admin panel under Plugins to confirm the update was successful. For additional details on the vulnerability and remediation, consult the Patchstack vulnerability database entry.

Workarounds

• Deploy a Web Application Firewall with rules configured to block requests containing path traversal sequences targeting WP Travel Engine
• Restrict access to the WordPress admin area and plugin directories using server-level access controls
• If immediate patching is not possible, consider temporarily disabling the WP Travel Engine plugin until an update can be applied
• Implement open_basedir PHP configuration to restrict file access to the WordPress installation directory

# Apache configuration to block common path traversal patterns
# Add to .htaccess or virtual host configuration
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.) [NC,OR]
    RewriteCond %{QUERY_STRING} (%2e%2e|%252e%252e) [NC]
    RewriteRule .* - [F,L]
</IfModule>