Local File Inclusion Vulnerability in WP Travel Engine Plugin

CVE-2026-9231 identifies a critical Local File Inclusion (LFI) vulnerability within the WP Travel Engine - Tour Booking Plugin for WordPress, affecting all versions up to and including 6.8.0. The flaw resides in the wte_get_template function, which fails to adequately sanitize input before using it to include server-side files. An attacker with at least contributor-level privileges can manipulate this function to traverse the directory structure and reference arbitrary .php files stored on the server. If an attacker can successfully upload a file containing malicious PHP code or leverage existing file upload functionality on the WordPress site, they can trigger the inclusion of these files, resulting in remote code execution (RCE). This vulnerability poses a high risk to WordPress installations as it allows for privilege escalation, sensitive data exfiltration, and full server compromise.

Impact

Successful exploitation of CVE-2026-9231 permits authenticated attackers to execute arbitrary code within the context of the web server process. This can lead to total site takeover, unauthorized access to the WordPress database, exfiltration of sensitive site configuration data, and potentially lateral movement within the hosting environment. Organizations using this plugin for tour booking and operations are at risk if they allow untrusted user accounts (contributors or above) on their WordPress platform.

Recommendation

1. Upgrade the WP Travel Engine plugin to a version patched against CVE-2026-9231 immediately.
2. Audit user permissions for the WordPress site and remove or demote any accounts with contributor-level or higher access that are not required for business operations.
3. Deploy the Sigma rule below to detect attempts to exploit local file inclusion vulnerabilities targeting the wte_get_template function.
4. Review file upload directories for unauthorized .php files that could serve as payloads for this LFI vulnerability.