CVE-2025-49308: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-49308) was discovered in the WordPress WP Travel Engine plugin affecting versions up to 6.5.1. The vulnerability was disclosed on June 5, 2025, and is classified as an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability (Patchstack, NVD).

The vulnerability is categorized as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and has received a CVSS v3.1 base score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability requires Contributor-level privileges to exploit (Patchstack).

This vulnerability could allow a malicious actor to include local files of the target website and display their contents. Particularly sensitive files containing credentials, such as database configuration files, could be exposed, potentially leading to complete database compromise depending on the system configuration (Patchstack).

The vulnerability has been patched in version 6.5.2 of the WP Travel Engine plugin. Users are advised to update to version 6.5.2 or later to remediate this security issue (Patchstack).