CVE-2026-9231: WP Travel Engine Plugin RCE Vulnerability

CVE-2026-9231 Overview

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress contains a Local File Inclusion (LFI) vulnerability affecting all versions up to and including 6.8.0. The flaw resides in the wte_get_template function, which fails to properly restrict user-controlled input used to build file paths. Authenticated attackers holding contributor-level access or higher can include and execute arbitrary .php files on the server. Successful exploitation allows attackers to bypass access controls, disclose sensitive information, or achieve remote code execution when combined with any file upload primitive that produces a .php file on disk.

Critical Impact
Contributor-level accounts can execute arbitrary PHP code by abusing the wte_get_template function, leading to full site compromise when chained with file upload vectors.

Affected Products

WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress
All versions up to and including 6.8.0
Fixed in version 6.8.1 via WordPress Changeset 3572382

Discovery Timeline

2026-09-22 - CVE-2026-9231 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-9231

Vulnerability Analysis

The vulnerability is categorized as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. The affected wte_get_template helper function accepts a template identifier and constructs a filesystem path that is then passed to a PHP include or require statement. Because the plugin does not sanitize the supplied template name against an allowlist, an attacker can traverse directories and target arbitrary .php files reachable by the web server user.

Exploitation requires a WordPress account with contributor privileges or higher, which lowers the barrier considerably on multi-author sites and membership platforms. Once an attacker controls the include path, any PHP file on the filesystem becomes an execution target. This includes log files, session files, or attacker-uploaded media containing PHP payloads.

Root Cause

The root cause is missing input validation in the wte_get_template function referenced in helpers.php line 955 and its callers in General.php line 52. User-supplied template identifiers reach the include statement without allowlist enforcement or path canonicalization, allowing directory traversal sequences to resolve outside the intended template directory.

Attack Vector

An authenticated attacker with contributor-level access submits crafted input, likely through a shortcode parameter processed by the plugin's General shortcode handler. The malicious value navigates the filesystem to reference an arbitrary .php file. When the server includes the file, PHP interprets and executes its contents in the plugin's execution context. Attackers commonly chain LFI with uploadable file types, log poisoning, or session file manipulation to convert file inclusion into remote code execution. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-9231

Indicators of Compromise

Web server logs containing directory traversal sequences such as ../ or encoded variants in shortcode-related parameters targeting WP Travel Engine endpoints.
Unexpected PHP execution originating from paths outside the plugin's templates directory.
New or modified administrator accounts and unfamiliar PHP files placed in wp-content/uploads/ following contributor-level authentication events.

Detection Strategies

Audit WordPress access logs for POST or GET requests referencing the WP Travel Engine shortcode processor with abnormal template parameter values.
Enable PHP open_basedir restrictions and monitor for include/require failures signaling probing attempts against non-template files.
Correlate contributor or author authentication events with subsequent shortcode rendering activity to surface potential abuse.

Monitoring Recommendations

Deploy a web application firewall with rules that block directory traversal patterns in WordPress plugin parameters.
Monitor filesystem changes in wp-content/plugins/wp-travel-engine/ and wp-content/uploads/ for newly written PHP files.
Alert on outbound network connections from the PHP-FPM or Apache worker process to uncommon destinations, which may indicate post-exploitation activity.

How to Mitigate CVE-2026-9231

Immediate Actions Required

Upgrade the WP Travel Engine plugin to version 6.8.1 or later immediately on all WordPress installations.
Review contributor, author, editor, and administrator accounts and remove or disable unused or suspicious accounts.
Rotate WordPress secret keys, salts, and any credentials that may have been exposed on affected hosts.

Patch Information

The vendor addressed the vulnerability in version 6.8.1. The fix is available in WordPress Changeset 3572382, which modifies the shortcode handler that invoked the unsafe wte_get_template code path. Site operators should confirm the installed plugin version through the WordPress admin dashboard after applying the update.

Workarounds

If patching is not immediately possible, restrict contributor-level and higher account creation and enforce multi-factor authentication for all authors and editors.
Deploy WAF rules that block requests containing directory traversal payloads targeting WP Travel Engine shortcodes.
Configure PHP open_basedir and disable_functions to limit filesystem exposure and reduce post-exploitation impact.

bash

# Configuration example: restrict PHP file inclusion scope via php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"