This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Local File Inclusion (LFI) via the `mode` parameter. π **Consequences**: Attackers can read sensitive server files or potentially execute arbitrary code, compromising the entire WordPress site integrity.
Q2Root Cause? (CWE/Flaw)
π‘οΈ **Root Cause**: CWE-98 (Improper Control of Filename for Include/Require). The plugin fails to sanitize the `mode` input before including files, allowing path traversal attacks.
Q3Who is affected? (Versions/Components)
π¦ **Affected**: WordPress Plugin **WP Travel Engine β Tour Booking Plugin β Tour Operator Software**. π **Version**: **6.6.7 and earlier**. π’ **Vendor**: wptravelengine.
Q4What can hackers do? (Privileges/Data)
π **Impact**: High Severity (CVSS 9.8). Hackers can achieve **Full System Compromise**. They can read sensitive data (C:H), modify site content (I:H), and disrupt service (A:H) without authentication.
Q5Is exploitation threshold high? (Auth/Config)
β‘ **Threshold**: **LOW**. CVSS Vector `AV:N/AC:L/PR:N/UI:N` indicates it is Network-accessible, Low Complexity, and requires **No Privileges** or User Interaction. Easy to exploit remotely.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Exploit Status**: No public PoC/Exploit listed in the data (`pocs: []`). However, the vulnerability is well-documented in source code diffs, making it highly likely to be exploited soon.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for installed version **< 6.6.7**. Check if the plugin is active. Look for AJAX endpoints related to `LoadTripsHtml` or `FilterTripsHtml` that accept unsanitized `mode` parameters.
Q8Is it fixed officially? (Patch/Mitigation)
π οΈ **Fix**: Update the plugin to the latest version immediately. The vendor has acknowledged the issue via WordPress Trac and Wordfence advisories. Patching resolves the LFI flaw.
Q9What if no patch? (Workaround)
π§ **Workaround**: If patching is delayed, **deactivate and delete** the WP Travel Engine plugin. Alternatively, restrict access to WordPress AJAX endpoints via WAF rules blocking suspicious `mode` parameter values.
Q10Is it urgent? (Priority Suggestion)
π₯ **Priority**: **CRITICAL**. With a CVSS score of 9.8 and no auth required, this is an immediate threat. Prioritize patching to prevent unauthorized access and data breaches.