CVE-2025-30871
Published: 27 March 2025
Summary
CVE-2025-30871 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wptravelengine Wp Travel Engine. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-30871 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include/require statements, tracked under CWE-98. It affects the WP Travel Engine WordPress plugin for versions up to and including 6.3.5, allowing an attacker to influence which local PHP files are loaded during execution.
An authenticated attacker with low privileges can supply a crafted filename parameter over the network to include arbitrary local files. Successful exploitation can lead to disclosure of sensitive information, execution of attacker-controlled code, or full compromise of the confidentiality, integrity, and availability of the affected site, though the attack requires high complexity due to the need for a specific execution path.
The referenced Patchstack advisory identifies the flaw in WP Travel Engine and indicates that the issue is resolved in versions newer than 6.3.5; site administrators should update the plugin to a patched release to eliminate the inclusion flaw.
EPSS remains low and unchanged at 0.0115 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8326
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel Engine WP Travel Engine wp-travel-engine allows PHP Local File Inclusion.This issue affects WP Travel Engine: from n/a through <= 6.3.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a local file inclusion vulnerability in a public-facing WordPress plugin, directly enabling exploitation via T1190: Exploit Public-Facing Application to achieve code execution or file access on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely identification, reporting, and correction of flaws like the LFI vulnerability in WP Travel Engine, preventing exploitation through patching.
Requires validation of information inputs such as filenames in PHP include/require statements, directly countering the improper control exploited in this LFI vulnerability.
Vulnerability scanning identifies the LFI flaw in the WP Travel Engine plugin, enabling proactive remediation before exploitation.