{"id":"CVE-2026-10834","aliases":["EUVD-2026-42010","GHSA-qj2j-73pj-4fxf"],"status":"published","title":"WP Travel Engine \u003c 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image","description":"The WP Travel Engine  WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00245,"percentile":0.15877,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-07T06:00:01Z","modified":"2026-07-09T18:32:35Z","products":[{"vendor":"unknown","product":"wp travel engine"},{"vendor":"wp travel engine","product":"wp travel engine"}],"references":[{"url":"https://wpscan.com/vulnerability/5b939f98-0fbd-4f89-9948-77dbcc67f9d3/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10834"},{"url":"https://wpscan.com/vulnerability/5b939f98-0fbd-4f89-9948-77dbcc67f9d3"},{"url":"https://github.com/advisories/GHSA-qj2j-73pj-4fxf"}],"sources":{"cve":[{"id":"CVE-2026-10834","title":"WP Travel Engine \u003c 6.8.1 - Subscriber+ Arbitrary Media File Move via user_profile_image","description":"The WP Travel Engine  WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.","status":"published","published":"2026-07-07T06:00:01.354Z","modified":"2026-07-09T15:01:48.5Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-42010","description":"The WP Travel Engine  WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.","status":"published","published":"2026-07-07T06:00:01Z","modified":"2026-07-09T15:01:48Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:04.126011Z"}],"ghsa":[{"id":"GHSA-qj2j-73pj-4fxf","title":"The WP Travel Engine  WordPress plugin before 6.8.1 does not properly validate the source of a...","description":"The WP Travel Engine  WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.","status":"published","published":"2026-07-07T06:31:24Z","modified":"2026-07-09T18:32:35Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:09:22.189239Z"}],"nvd":[{"id":"CVE-2026-10834","description":"The WP Travel Engine  WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.","status":"published","published":"2026-07-07T06:16:21.637Z","modified":"2026-07-09T16:16:34.507Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:28.040501Z"}]}}