CVE-2026-10834: WP Travel Engine Path Traversal Flaw

CVE-2026-10834 Overview

CVE-2026-10834 affects the WP Travel Engine WordPress plugin in versions prior to 6.8.1. The plugin fails to validate the source of a user-supplied profile image path before moving the file. Authenticated users with subscriber-level access or above can relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This action removes the targeted media from its original location and can break site content that references those files.

Critical Impact
Low-privileged authenticated users can relocate arbitrary files inside the WordPress uploads directory, breaking media references across the site and impacting content integrity and availability.

Affected Products

WP Travel Engine WordPress plugin versions prior to 6.8.1
WordPress sites with subscriber-level registration enabled and the plugin active
Any content referencing media stored in the WordPress uploads directory on affected installations

Discovery Timeline

2026-07-07 - CVE-2026-10834 published to NVD
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-10834

Vulnerability Analysis

The vulnerability is a broken access control and input validation flaw in the profile image handling logic of the WP Travel Engine plugin. When a user submits a profile image path, the plugin moves the referenced file into the user's profile-image directory without verifying that the source path belongs to the requesting user. An authenticated attacker with at least subscriber privileges can supply a path pointing to any file within the WordPress uploads directory.

Because the operation is a move rather than a copy, the original file is removed from its previous location. Media referenced by posts, pages, or other plugins becomes unavailable, producing broken images and disrupted layouts. The impact is limited to integrity and availability of media assets. Confidentiality is not affected, since the attacker cannot read file contents through this flow.

Root Cause

The root cause is missing ownership and origin validation on the source path parameter used by the profile image handler. The plugin trusts the client-supplied path and passes it directly into a filesystem move operation. There is no check that the source file belongs to the authenticated user or that the target action is authorized.

Attack Vector

Exploitation requires network access, an authenticated account at subscriber level or above, and user interaction on the target's profile flow. An attacker submits a crafted profile update request referencing a file path inside the site's uploads directory. The plugin then relocates that file into the attacker's profile-image path, breaking the original reference elsewhere on the site. Full technical detail is documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-10834

Indicators of Compromise

Unexpected disappearance of media files from wp-content/uploads/ referenced by posts and pages
New or modified files in per-user profile image directories that match filenames previously used elsewhere on the site
Subscriber-level accounts issuing repeated profile update requests to WP Travel Engine endpoints
Broken image links appearing across multiple pieces of content within a short time window

Detection Strategies

Compare current uploads directory contents against backups to identify files that have been moved out of their original paths
Review web server logs for authenticated POST requests to WP Travel Engine profile update endpoints originating from low-privilege accounts
Correlate WordPress user metadata changes with filesystem move events on the uploads directory

Monitoring Recommendations

Enable file integrity monitoring on wp-content/uploads/ to alert on unexpected move or delete operations
Log and review all profile update actions submitted by subscriber and contributor roles
Alert on bulk changes to media attachment references in the WordPress database

How to Mitigate CVE-2026-10834

Immediate Actions Required

Update the WP Travel Engine plugin to version 6.8.1 or later on all affected WordPress sites
Audit subscriber and higher-level accounts for suspicious profile update activity since the plugin was installed
Restore any media files that have been relocated out of their original uploads paths from backup

Patch Information

The vendor addressed CVE-2026-10834 in WP Travel Engine version 6.8.1. The fix validates the source of the supplied profile image path before performing the file move. Site administrators should apply the update through the WordPress plugin manager. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the WP Travel Engine plugin until the update to 6.8.1 can be applied
Restrict new user registration or limit subscriber-level account creation on affected sites
Apply web application firewall rules that block profile update requests containing traversal-style or absolute paths in the source parameter

bash

# Configuration example: update WP Travel Engine via WP-CLI
wp plugin update wp-travel-engine --version=6.8.1
wp plugin get wp-travel-engine --field=version