Wptravelengine vulnerabilities
We track 7 vulnerabilities in Wptravelengine products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Wptravelengine vulnerabilities
- 7.5 High severity
WP Travel Engine – Tour Booking Plugin – Tour…: Improper Control of Filename for Include/Require Statement in PHP Program
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, wi
- 7.5 High severity
WP Travel Engine – Tour Booking Plugin – Tour…: Missing Authorization
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an
- 9.8 Critical severity
WP Travel Engine – Tour Booking Plugin – Tour…: Improper Control of Filename for Include/Require Statement in PHP Program
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include a
- 9.8 Critical severity
WP Travel Engine – Tour Booking Plugin – Tour…: Improper Limitation of a Pathname to a Restricted Directory
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image function in all versions up to, and includin
- 7.5 High severity
WP Travel Engine – Tour Booking Plugin – Tour…: Missing Authorization
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it po
- 8.8 High severity
WP Travel Engine – Elementor Widgets | Create…: Improper Control of Filename for Include/Require Statement in PHP Program
The WP Travel Engine – Elementor Widgets | Create Travel Booking Website Using WordPress and Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.7 via several widgets. This makes it possible for authen
- 7.2 High severity
WP Travel Engine: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.