CVE-2025-7526: WP Travel Engine Path Traversal Flaw

CVE-2025-7526 Overview

CVE-2025-7526 is a critical path traversal vulnerability affecting the WP Travel Engine – Tour Booking Plugin for WordPress. The vulnerability exists in the set_user_profile_image function, which fails to properly validate file paths before performing file operations. This insufficient validation allows unauthenticated attackers to delete arbitrary files on the server through a file renaming mechanism.

The severity of this vulnerability stems from its potential to enable remote code execution. When critical WordPress configuration files such as wp-config.php are deleted, the WordPress installation enters a setup state, potentially allowing attackers to reconfigure the application with malicious settings or gain complete control over the server.

Critical Impact

Unauthenticated attackers can delete arbitrary server files, potentially leading to remote code execution by removing critical WordPress configuration files.

Affected Products

• WP Travel Engine – Tour Booking Plugin versions up to and including 6.6.7
• WordPress installations utilizing the vulnerable plugin
• Tour operator websites running affected plugin versions

Discovery Timeline

• 2025-10-09 - CVE-2025-7526 published to NVD
• 2025-10-09 - Last updated in NVD database

Technical Details for CVE-2025-7526

Vulnerability Analysis

This vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal. The set_user_profile_image function in the WP Travel Engine plugin does not adequately sanitize or validate user-supplied file paths before processing file operations. This oversight allows attackers to manipulate file path parameters to target files outside the intended directory structure.

The attack requires no authentication, meaning any remote attacker with network access to the WordPress installation can exploit this vulnerability. The exploitation does not require user interaction, and the attack complexity is low, making this a highly exploitable flaw in production environments.

Root Cause

The root cause lies in the set_user_profile_image function located in class-wp-travel-engine-form-handler.php. The function accepts user input for file path operations but fails to implement proper path canonicalization or directory restriction checks. Without these safeguards, directory traversal sequences (such as ../) can be injected to escape the intended upload directory and target arbitrary files on the filesystem.

Attack Vector

The vulnerability is exploited via network requests to the WordPress installation. An attacker crafts a malicious request to the profile image handling functionality, injecting path traversal sequences into the file path parameter. The vulnerable function processes this input without proper validation, resulting in the deletion of the specified file through the renaming operation.

When targeting wp-config.php, the deletion triggers WordPress's installation wizard on the next page load. An attacker can then intercept this state to reconfigure the database connection to a malicious server, effectively gaining code execution capabilities on the WordPress installation.

The vulnerable code can be examined in the WordPress Travel Engine Code repository. Additional technical details are available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-7526

Indicators of Compromise

• Unexpected HTTP requests to profile image upload endpoints with path traversal patterns (../)
• Missing or deleted critical WordPress files such as wp-config.php
• WordPress unexpectedly entering installation/setup mode
• Web server logs showing unusual file path patterns in requests to WP Travel Engine endpoints

Detection Strategies

• Monitor web application firewall logs for path traversal sequences targeting WP Travel Engine endpoints
• Implement file integrity monitoring for critical WordPress configuration files
• Review access logs for unauthenticated requests to user profile image functionality
• Deploy intrusion detection rules matching common path traversal patterns in POST parameters

Monitoring Recommendations

• Configure alerting for any modifications or deletions of wp-config.php and other critical WordPress files
• Implement real-time log analysis for requests containing directory traversal sequences
• Monitor for anomalous plugin activity, particularly around file handling operations
• Establish baseline file checksums for critical WordPress installation files

How to Mitigate CVE-2025-7526

Immediate Actions Required

• Update WP Travel Engine plugin to a version newer than 6.6.7 immediately
• Implement web application firewall rules to block path traversal attempts
• Review server logs for evidence of exploitation attempts
• Verify integrity of critical WordPress files, especially wp-config.php

Patch Information

Organizations using the WP Travel Engine plugin should update to the latest version that addresses this vulnerability. The patch implements proper file path validation in the set_user_profile_image function to prevent path traversal attacks. Check the WordPress plugin repository for the latest secure version and apply the update through the WordPress admin dashboard or via direct plugin file replacement.

Workarounds

• Temporarily disable the WP Travel Engine plugin until a patch can be applied if immediate update is not possible
• Implement server-level file permissions to protect critical WordPress configuration files
• Deploy WAF rules to filter requests containing path traversal sequences to the affected endpoint
• Restrict network access to WordPress administrative functions where feasible

# Configuration example - WAF rule to block path traversal attempts
# Apache mod_rewrite rule
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
RewriteCond %{REQUEST_URI} (\.\./|\.\.\\) [NC]
RewriteRule .* - [F,L]

# Protect wp-config.php from deletion
chmod 400 /path/to/wordpress/wp-config.php
chattr +i /path/to/wordpress/wp-config.php