CVE-2025-30870: WP Travel Engine Path Traversal Flaw

CVE-2025-30870 Overview

CVE-2025-30870 is a PHP Local File Inclusion (LFI) vulnerability affecting WP Travel Engine, a popular WordPress plugin used for creating travel booking websites. The vulnerability stems from improper control of filename for include/require statements in PHP, allowing attackers to include arbitrary local files on the server. This weakness can be exploited to read sensitive configuration files, execute malicious PHP code, or potentially escalate to remote code execution under certain server configurations.

Critical Impact
Unauthenticated attackers can exploit this LFI vulnerability to read sensitive files, potentially exposing database credentials, API keys, and other confidential data. Under specific conditions, this could lead to full site compromise.

Affected Products

WP Travel Engine plugin for WordPress versions through 6.3.5
WordPress sites using affected WP Travel Engine versions
Travel booking websites built with vulnerable plugin installations

Discovery Timeline

2025-04-01 - CVE-2025-30870 published to NVD
2025-05-27 - Last updated in NVD database

Technical Details for CVE-2025-30870

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and CWE-706 (Use of Incorrectly-Resolved Name or Reference). The flaw exists in how the WP Travel Engine plugin processes user-supplied input when constructing file paths for PHP include or require statements.

When a PHP application uses dynamic file inclusion without proper validation, an attacker can manipulate the file path to include unintended files from the local filesystem. In the context of WordPress, this is particularly dangerous as attackers can potentially include files like wp-config.php to extract database credentials, or include log files that may contain injected PHP code.

The vulnerability is accessible over the network without requiring authentication or user interaction, making it highly exploitable in automated attack scenarios.

Root Cause

The root cause lies in insufficient input validation and sanitization when handling filename parameters used in PHP include or require statements. The plugin fails to properly validate and restrict which files can be included, allowing directory traversal sequences (e.g., ../) or absolute paths to be processed. Without proper whitelisting of allowed files or directories, attackers can navigate outside the intended directory scope and access sensitive system files.

Attack Vector

The attack can be executed remotely over the network against any WordPress site running a vulnerable version of WP Travel Engine. An attacker does not need any authentication credentials or special privileges to exploit this vulnerability. The attack typically involves crafting malicious HTTP requests containing path traversal sequences or manipulated file paths targeting the vulnerable include functionality.

Successful exploitation could allow an attacker to:

Read sensitive configuration files containing database credentials
Access WordPress secret keys and salts
Include PHP files to execute arbitrary code (if combined with file upload capabilities)
Extract user data and session information
Potentially achieve full server compromise through log poisoning techniques

For detailed technical information about this vulnerability, refer to the Patchstack security advisory.

Detection Methods for CVE-2025-30870

Indicators of Compromise

Unusual HTTP requests containing directory traversal sequences (../, ..%2F, %2e%2e/) targeting WP Travel Engine endpoints
Web server access logs showing requests attempting to access sensitive files like wp-config.php, /etc/passwd, or log files
Unexpected file access patterns in PHP error logs indicating failed file inclusion attempts
Signs of credential theft or unauthorized database access following successful exploitation

Detection Strategies

Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts targeting WordPress plugins
Monitor web server logs for anomalous requests containing encoded traversal sequences or attempts to include files outside the plugin directory
Deploy intrusion detection systems with signatures for LFI attack patterns specific to WordPress environments
Use file integrity monitoring on critical WordPress configuration files to detect unauthorized access

Monitoring Recommendations

Enable detailed access logging on web servers to capture full request URIs and parameters
Configure alerts for repeated 4xx or 5xx errors that may indicate exploitation attempts
Monitor for unusual outbound connections that could indicate data exfiltration following successful exploitation
Implement real-time log analysis to detect patterns consistent with automated scanning tools targeting this vulnerability

How to Mitigate CVE-2025-30870

Immediate Actions Required

Update WP Travel Engine plugin to a version newer than 6.3.5 immediately
Audit web server logs for any signs of exploitation attempts prior to patching
Review and rotate database credentials if compromise is suspected
Implement WAF rules to block path traversal attempts as a temporary measure while patching

Patch Information

The vulnerability affects WP Travel Engine versions through 6.3.5. Website administrators should update to the latest available version through the WordPress plugin repository. After updating, verify the plugin version in the WordPress admin panel under Plugins to confirm the update was successful. For additional details on the vulnerability and remediation, consult the Patchstack vulnerability database entry.

Workarounds

Deploy a Web Application Firewall with rules configured to block requests containing path traversal sequences targeting WP Travel Engine
Restrict access to the WordPress admin area and plugin directories using server-level access controls
If immediate patching is not possible, consider temporarily disabling the WP Travel Engine plugin until an update can be applied
Implement open_basedir PHP configuration to restrict file access to the WordPress installation directory

bash

# Apache configuration to block common path traversal patterns
# Add to .htaccess or virtual host configuration
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.) [NC,OR]
    RewriteCond %{QUERY_STRING} (%2e%2e|%252e%252e) [NC]
    RewriteRule .* - [F,L]
</IfModule>