Critical · published October 9, 2025
🚨 A simple name change can turn devastating! The WP Travel Engine plugin, up to version 6.6.7, has a critical flaw that allows unauthenticated attackers to delete any file on your server! 🔥 Think of your website like a treasure chest; if someone can rename the lock, they can throw away the treasures inside! In this case, a sneaky attacker can delete vital files just by manipulating a profile image function, leaving your site wide open. If exploited, an attacker could delete crucial files such as wp-config.php, opening the door to total chaos! This means they could potentially take control of your server and execute any code they like, leading to absolute disaster for your site and data.
Think of your website like a treasure chest; if someone can rename the lock, they can throw away the treasures inside! In this case, a sneaky attacker can delete vital files just by manipulating a profile image function, leaving your site wide open. This vulnerability arises from insufficient file path validation in the set_user_profile_image function of the WP Travel Engine plugin, enabling attackers to delete arbitrary server files without authentication.
If exploited, an attacker could delete crucial files such as wp-config.php, opening the door to total chaos! This means they could potentially take control of your server and execute any code they like, leading to absolute disaster for your site and data. Update the WP Travel Engine plugin to version 6.6.8 or higher immediately to patch this vulnerability. Additionally, review your server's file permissions and ensure proper validation is in place to prevent unauthorized access. You've got this! With these actions, you can lock down your site and keep those attackers at bay! 🛡️