CVE-2026-10834: WP Travel Engine Arbitrary File Relocation in WordPress Plugin

Technical summary

CVE-2026-10834 stems from insufficient path validation in the WP Travel Engine plugin's profile image upload handler. The plugin fails to verify that the source file path supplied by an authenticated user actually belongs to that user's profile, enabling path traversal within the WordPress uploads directory. An authenticated subscriber can craft a request specifying an arbitrary file path and trigger a file move operation that relocates the target file into their own profile-image location. The CVSS 3.1 vector (4.6 MEDIUM, AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) reflects that the attack requires network access, low complexity, low-level privileges, user interaction, and results in integrity and availability impacts without confidentiality breach.

Business impact

This vulnerability can disrupt site functionality and user experience. Media files moved by a malicious subscriber may cause broken images and missing content across published pages and posts. While confidential data is not exposed, the ability for any authenticated user to disrupt media organization and availability represents a denial-of-service risk to site operations and editorial workflows. Organizations relying on the WP Travel Engine plugin should assess whether untrusted users have subscriber-level access or above.

Affected systems

WP Travel Engine WordPress plugin versions before 6.8.1 are vulnerable. The ground-truth data provided does not specify which vendor or product is affected by this CVE, so validation against official vendor advisories is essential before deployment decisions. Organizations should verify the exact scope of affected versions through the plugin developer's security notices.

Exploitability

Exploitation is straightforward but requires two preconditions: first, the attacker must be an authenticated WordPress user with subscriber-level access or higher; second, the user interaction requirement in the CVSS vector indicates that the malicious action is not automatic—the attacker must trigger the file move through a deliberate user action or social engineering. The low access complexity means no special tools or setup beyond normal WordPress login capability are needed. The attack is network-accessible and does not require elevated privileges within WordPress.

Remediation

Upgrade the WP Travel Engine plugin to version 6.8.1 or later. This patch version includes proper validation of the profile image source path, preventing arbitrary file relocation. Organizations unable to upgrade immediately should restrict subscriber-level access to only trusted users and monitor file-move operations in WordPress activity logs.

Patch guidance

Verify that WP Travel Engine is updated to version 6.8.1 or later by checking the Plugins page in your WordPress admin dashboard. Automatic updates can be enabled to receive patches promptly. Before applying any patch in a production environment, test on a staging copy of your site to ensure compatibility with other plugins and themes. The patch should be treated as a priority update given the ease of exploitation by internal users.

Detection guidance

Monitor WordPress activity logs and audit trails for suspicious file-move operations originating from subscriber-level user accounts. Check the uploads directory structure for unexpected file relocations into user profile image directories. Web application firewalls (WAF) can be tuned to flag unusual file-move requests in the WP Travel Engine plugin's profile upload endpoints. WordPress security plugins that track file system changes will detect when media files are unexpectedly moved.

Why prioritize this

Although the CVSS score is MEDIUM (4.6), this vulnerability merits prompt attention because it can be exploited by any authenticated subscriber without advanced technical skills. The impact on content integrity and site availability is direct and visible to end users. The ease of exploitation and broad eligibility (any subscriber or above) make this a usability and operational risk even if not a critical security threat. Organizations with public subscriber registration or numerous internal users should deprioritize this as lower-risk compared to remote code execution vulnerabilities, but should not delay patching indefinitely.

Risk score, explained

The CVSS 3.1 score of 4.6 reflects a MEDIUM severity rating. The score is moderated by the requirement for prior authentication and user interaction, which narrow the attack surface compared to unauthenticated remote attacks. However, the low privileges required (subscriber) and low complexity keep the score from dropping further. The impact is limited to integrity and availability of media files, not confidentiality of user data. For risk prioritization, consider whether your WordPress site allows untrusted subscriber registrations; if it does, the practical risk may be higher than the base score suggests.

Frequently asked questions