CVE-2025-30891: WpTravelly Path Traversal Vulnerability

CVE-2025-30891 Overview

CVE-2025-30891 is a Local File Inclusion (LFI) vulnerability in the WpTravelly tour-booking-manager WordPress plugin from magepeopleteam. The plugin fails to properly control filenames passed to PHP include or require statements [CWE-98]. Authenticated attackers can leverage this flaw to include arbitrary local files on the server, leading to information disclosure and potential code execution. The vulnerability affects all WpTravelly versions from initial release through 1.8.7.

Critical Impact
An authenticated attacker with low privileges can include arbitrary PHP files on the server over the network, resulting in confidentiality, integrity, and availability compromise of the WordPress host.

Affected Products

magepeopleteam WpTravelly (tour-booking-manager plugin)
WpTravelly versions through 1.8.7
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-03-27 - CVE-2025-30891 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30891

Vulnerability Analysis

The vulnerability is classified under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. The WpTravelly plugin accepts user-controlled input and passes it to a PHP file inclusion function without sufficient validation or sanitization. While the CVE title references PHP Remote File Inclusion, the issue manifests as a Local File Inclusion (LFI) condition.

An attacker with at least low-privilege authentication can craft a request that manipulates a parameter used in an include or require call. Once a malicious path is processed, the PHP interpreter loads and executes the referenced file in the context of the web server. This grants the attacker the ability to read sensitive files such as wp-config.php or execute previously uploaded content.

Root Cause

The root cause is missing or insufficient input validation on a filename parameter consumed by a PHP file inclusion statement inside the WpTravelly plugin. The plugin trusts attacker-influenced input when resolving the path to a PHP file, allowing directory traversal sequences and arbitrary local paths to be processed by the interpreter.

Attack Vector

The attack vector is network-based and requires low-privilege authentication on the target WordPress instance. No user interaction is required. An attacker sends a crafted HTTP request to a vulnerable endpoint exposed by the tour-booking-manager plugin, supplying a manipulated filename parameter. The PHP runtime then includes the targeted file, executing any PHP code it contains. Technical exploitation details are documented in the Patchstack WordPress Vulnerability Listing.

Detection Methods for CVE-2025-30891

Indicators of Compromise

HTTP requests to WpTravelly plugin endpoints containing directory traversal sequences such as ../ or encoded variants like %2e%2e%2f.
Access log entries showing requests to plugin parameters with filesystem paths referencing wp-config.php, /etc/passwd, or /proc/self/environ.
Unexpected PHP errors in web server logs referencing include() or require() failures from tour-booking-manager plugin files.
New or modified PHP files in WordPress upload directories that correlate with plugin request activity.

Detection Strategies

Inspect WordPress access logs for authenticated requests targeting tour-booking-manager endpoints with suspicious file path parameters.
Deploy web application firewall (WAF) rules that flag traversal patterns and inclusion of sensitive system files in plugin query strings.
Correlate authenticated subscriber or contributor sessions with anomalous PHP error rates on plugin paths.

Monitoring Recommendations

Enable verbose PHP error logging and forward logs to a centralized analysis platform for path inclusion anomalies.
Monitor file integrity on the WordPress installation, especially wp-content/plugins/tour-booking-manager/ and the uploads/ directory.
Alert on outbound connections initiated by the PHP-FPM or web server process to unexpected destinations.

How to Mitigate CVE-2025-30891

Immediate Actions Required

Identify all WordPress instances running the WpTravelly tour-booking-manager plugin at version 1.8.7 or earlier.
Update the plugin to a version higher than 1.8.7 as soon as the vendor publishes a patched release.
Restrict access to WordPress authoring roles and audit existing low-privilege accounts for unauthorized creation.
Review web server and PHP logs for prior exploitation attempts that reference plugin endpoints.

Patch Information

At the time of NVD publication, the vulnerability affects WpTravelly through version 1.8.7. Administrators should consult the Patchstack WordPress Vulnerability Listing and the magepeopleteam plugin page for the latest fixed release. Apply the vendor update through the WordPress plugin manager once available.

Workarounds

Deactivate and remove the WpTravelly plugin until a patched version is installed if the plugin is not business-critical.
Apply WAF rules that block directory traversal sequences and known sensitive file paths in requests targeting tour-booking-manager endpoints.
Configure PHP open_basedir to restrict the directories accessible to the WordPress process, limiting the impact of arbitrary file inclusion.
Disable file upload capabilities for low-privilege roles to reduce the likelihood of attacker-controlled PHP being staged for inclusion.

bash

# Example php.ini hardening to constrain file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off