CVE-2025-30870 is a High severity (CVSS 8.1) local file inclusion flaw in the WP Travel Engine WordPress plugin, versions up to and including 6.3.5. Patchstack lists 6.3.6 as the patched release, so update the plugin now and check that no unexpected files were read or run.
What's affected
The record covers the WP Travel Engine plugin (slug wp-travel-engine) from WP Travel Engine, in every version up to and including 6.3.5. The NVD description names the weakness as improper control of the filename used in an include or require statement in a PHP program, which allows local file inclusion.
The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. That means the flaw is reachable over the network, needs no account, and has high impact on confidentiality, integrity and availability, with high attack complexity.
Patchstack's database entry says the required privilege is unauthenticated and that version 6.3.6 fixes the problem. The record does not mark this CVE as exploited in the wild, and it is not in the CISA KEV list.
How to check if you're exposed
If you have shell access and WP-CLI, list the installed version of the plugin:
wp plugin get wp-travel-engine --fields=name,version,status
To see every plugin that has an update waiting, run:
wp plugin list --update=available --fields=name,version,update_version
Without WP-CLI, open Plugins in the WordPress admin and read the version under the plugin name. Anything at 6.3.5 or lower is affected. Also check multisite networks and staging copies, since forgotten installs are the ones that stay vulnerable.
If the plugin is deactivated but still on disk, treat it as installed. Remove it if you do not use it.
What to do now
- Update WP Travel Engine to 6.3.6 or later from the Plugins screen, or run
wp plugin update wp-travel-engine. - If you cannot update today, deactivate and delete the plugin, or restrict access to the site with a web application firewall rule from your host.
- Review web server logs for requests to the plugin's paths that carry unusual file path values, such as repeated parent directory sequences. A hit is a reason to investigate, not proof of compromise.
- Check that file permissions on
wp-config.phpand other sensitive files are as tight as your host allows, and rotate database credentials and salts if you suspect a file was read. - Add the plugin to your dependency inventory so the next advisory reaches you without a manual search.
Why it matters
Local file inclusion happens when a PHP script builds the path of a file to load from a value the visitor can influence, without limiting it to a safe list. The weakness behind it is CWE-98, with CWE-706 describing the wider problem of a program controlling the wrong resource. Depending on what the server can reach, an attacker may read configuration files, or cause PHP code in files already on disk to run.
WordPress plugins are a common place for this class of bug because they load templates and helper files by name. The fix is usually to check the requested name against an allowlist or to resolve the real path and confirm it stays inside the plugin directory. The lesson for site owners is mostly operational: plugin flaws like this one are found, published and scanned for within days, so a patching routine beats a one time review.
Quick check
Do I need to be logged in to be affected?
Patchstack lists the required privilege as unauthenticated, so a visitor without an account can reach the flaw. Update instead of relying on login protections.
Is it enough to deactivate the plugin?
Deactivating is a good stopgap, but delete the plugin if you do not use it. Files left on disk can sometimes still be requested directly, so removal is safer.
Sources
Last reviewed: 19 October 2026.
