CVE-2025-30870
Published: 01 April 2025
Summary
CVE-2025-30870 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wptravelengine Wp Travel Engine. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 25.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue stemming from improper control of filenames in include/require statements, present in the WP Travel Engine WordPress plugin. It affects all versions through 6.3.5 and is tracked under CWE-98 and CWE-706.
An unauthenticated remote attacker can exploit the flaw over the network, albeit with high attack complexity, to include and execute arbitrary local files. Successful exploitation can yield full confidentiality, integrity, and availability impact on the affected site.
The issue is documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-travel-engine/vulnerability/wordpress-wp-travel-engine-plugin-6-3-5-local-file-inclusion-vulnerability-2, which points to an available patch for the plugin.
EPSS scores remain low with only a minor increase from 0.0078 to a peak of 0.0103, providing no indication of emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9086
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.