CyberRota Analysis
AI-GeneratedThe WP Travel Engine plugin for WordPress prior to version 6.8.1 is vulnerable to improper validation of user-supplied profile image paths, enabling authenticated users with subscriber-level access and higher to move arbitrary files within the WordPress uploads directory. This can lead to the unintended relocation of media files, potentially disrupting content across the site. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.