CVE-2026-10834
MediumCVSS 4.6Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The WP Travel Engine WordPress plugin before version 6.8.1 fails to properly validate the source of a user-supplied profile image path before moving the file. This allows authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path.
Risk Assessment
An attacker can remove media files from their original locations, breaking content across the site such as images in posts or galleries. This can disrupt website functionality and impact its credibility.
Recommendation
Immediately update the WP Travel Engine plugin to version 6.8.1 or later. Restrict user permissions to the minimum necessary and regularly monitor logs for suspicious file operations.
Original NVD description (English source)
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.