CVE-2026-10834

WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image

Medium · published July 7, 2026

CVSS v3.1
4.6
EPSS
0%
Percentile
14.9
In the wild
Unconfirmed
What it is

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.

The record
Technical detail
CVSS v3.1
4.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00245 · 14.9th percentile
Published
2026-07-07T06:00Z
EPSS history
Timeline
  • 07 JUL 06:00Z
    WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image
    cvelistv5