CVE-2025-7634

Critical

Published: 09 October 2025

Published

09 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0063 70.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-7634 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-7634, published on 2025-10-09, is a Local File Inclusion (LFI) vulnerability (CWE-98) in the WP Travel Engine – Tour Booking Plugin – Tour Operator Software for WordPress, affecting all versions up to and including 6.6.7. The flaw stems from inadequate validation of the "mode" parameter, enabling attackers to include and execute arbitrary .php files on the server. This carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact confidentiality, integrity, and availability violations.

Unauthenticated attackers can exploit this vulnerability remotely over the network with low complexity and no user interaction. By manipulating the "mode" parameter, they can include arbitrary PHP files, leading to execution of PHP code within those files. This allows bypassing access controls, extracting sensitive data, or achieving remote code execution, particularly in scenarios where .php file uploads are permitted elsewhere on the site.

Mitigation guidance is available in advisories such as the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/ce119965-01a0-4cff-a0b2-e99bceb1406c?source=cve. Vulnerable code locations include lines in FilterTripsHtml.php (https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/FilterTripsHtml.php#L72) and LoadTripsHtml.php (https://plugins.trac.wordpress.org/browser/wp-travel-engine/tags/6.6.0/includes/classes/Core/Controllers/Ajax/LoadTripsHtml.php#L27). Security practitioners should update to a patched version if available and review sites running affected plugin versions.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-33237

Vulnerability details

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers…

to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is an unauthenticated LFI leading to PHP code execution in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0