CVE-2025-7526 is a critical arbitrary file deletion vulnerability affecting the WP Travel Engine – Tour Booking Plugin for WordPress, in all versions up to and including 6.6.7, due to insufficient file path validation. This flaw allows unauthenticated attackers to delete arbitrary files on the server, potentially leading to remote code execution if critical files like wp-config.php are targeted. With a CVSS score of 9.8 (CRITICAL), the vulnerability has a low attack complexity and no user interaction required, enabling complete compromise of confidentiality, integrity, and availability. While there is no known active exploitation, public exploit code, or KEV listing, the vulnerability has garnered some community discussion, indicating awareness of its severe potential.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Wptravelengine | WP Travel Engine – Tour Booking Plugin – Tour Operator Software | >= 0, <= 6.6.7CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.