CVE-2026-10834 — WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated us…
Published: 2026-07-07 · CVSS: 4.6 · CVSS 3.1
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7