WP Travel Engine – Tour Booking Plugin – Tour Operator Software vulnerabilities
5 known vulnerabilities in WP Travel Engine – Tour Booking Plugin – Tour Operator Software from Wptravelengine. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
WP Travel Engine – Tour Booking Plugin – Tour…: Improper Control of Filename for Include/Require Statement in PHP Program
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wte_get_template function. This makes it possible for authenticated attackers, wi
- 7.5 High severity
WP Travel Engine – Tour Booking Plugin – Tour…: Missing Authorization
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an
- 9.8 Critical severity
WP Travel Engine – Tour Booking Plugin – Tour…: Improper Control of Filename for Include/Require Statement in PHP Program
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.6.7 via the mode parameter. This makes it possible for unauthenticated attackers to include a
- 9.8 Critical severity
WP Travel Engine – Tour Booking Plugin – Tour…: Improper Limitation of a Pathname to a Restricted Directory
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to arbitrary file deletion (via renaming) due to insufficient file path validation in the set_user_profile_image function in all versions up to, and includin
- 7.5 High severity
WP Travel Engine – Tour Booking Plugin – Tour…: Missing Authorization
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_package() function in all versions up to, and including, 6.5.1. This makes it po