CPE
An unauthenticated-accessible Local File Inclusion vulnerability in the WP Travel Engine plugin (CVE-2026-9231) allows authenticated contributors to achieve remote code execution by including arbitrary PHP files.