CVE-2026-49770: WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the WP Travel Engine WordPress plugin affecting all versions up to and including 6.7.12. The flaw is reachable over the network without any authentication, meaning any external attacker can send a crafted request to a vulnerable site. Successful exploitation gives the attacker full read, write, and availability impact over the affected environment, including potential remote code execution depending on the classes available in the application. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment the upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can send a crafted HTTP request from any remote location without needing LAN or VPN access.

• AuthenticationNot required

  No account or session credential of any privilege level is needed; the injection vector is accessible to completely unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator of the affected site.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• A successful attacker can read sensitive data from the application, including configuration values, stored credentials, and user records.
• The attacker can write or modify persisted application data, including plugin settings, user account details, and site content.
• The attacker can disrupt availability of the affected service, causing crashes or denial of service for site visitors.
• Depending on the PHP classes loaded by the application (known as a POP chain), the attacker may achieve arbitrary remote code execution on the underlying server.