CVE-2025-1771

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1771", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-28T05:52:16.720Z", "datePublished": "2025-03-15T04:22:07.953Z", "dateUpdated": "2026-04-08T17:27:18.456Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:18.456Z"}, "affected": [{"vendor": "ShineTheme", "product": "Travel Booking WordPress Theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}], "title": "Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da3e3d6c-7643-4f22-aa88-2c4ce80aed1f?source=cve"}, {"url": "https://travelerwp.com/traveler-changelog/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-02-28T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-02-28T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-14T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-17T16:54:27.981882Z", "id": "CVE-2025-1771", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T16:54:36.225Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1771", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-17T16:54:27.981882Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-17T16:54:32.478Z"}}], "cna": {"title": "Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "ShineTheme", "product": "Travel Booking WordPress Theme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.8"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-28T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-02-28T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-14T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da3e3d6c-7643-4f22-aa88-2c4ce80aed1f?source=cve"}, {"url": "https://travelerwp.com/traveler-changelog/"}], "descriptions": [{"lang": "en", "value": "The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:27:18.456Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1771", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:27:18.456Z", "dateReserved": "2025-02-28T05:52:16.720Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-15T04:22:07.953Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Travel Booking WordPress Theme", "vendor": "ShineTheme", "versions": [{"lessThanOrEqual": "3.1.8", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:shinecommerce:traveler:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "7109F257-C617-40B4-8187-FF273299E9B8", "versionEndExcluding": "3.1.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}, {"lang": "es", "value": "El tema Traveler para WordPress es vulnerable a la inclusi\u00f3n de archivos locales en todas las versiones hasta la 3.1.8 incluida, a trav\u00e9s del par\u00e1metro 'style' de la funci\u00f3n 'hotel_alone_load_more_post'. Esto permite a atacantes no autenticados incluir y ejecutar archivos arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en dichos archivos. Esto puede utilizarse para eludir los controles de acceso, obtener datos confidenciales o ejecutar c\u00f3digo cuando se permite subir e incluir archivos PHP."}], "id": "CVE-2025-1771", "lastModified": "2026-06-17T08:39:45.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1771", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-17T16:54:27.981882Z", "version": "2.0.3"}}]}, "published": "2025-03-15T05:15:47.253", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://travelerwp.com/traveler-changelog/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/da3e3d6c-7643-4f22-aa88-2c4ce80aed1f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-29T01:02:10.942686+00:00", "value": {"mitigation_remediation": ["Update the Traveler theme to the latest available version (3.1.9 or newer) immediately.", "If an update cannot be applied, disable or remove the hotel_alone_load_more_post function and the 'style' parameter from public access.", "Configure the web server or a WAF to block or sanitize the style parameter from containing path traversal sequences and ensure only safe, non-php file types are uploaded or included."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of the ShineTheme Travel Booking WordPress Theme running a version 3.1.8 or earlier are impacted. The vulnerability applies to the function available publicly via the WordPress site.", "description_and_impact": "The Traveler WordPress theme is vulnerable in versions up to 3.1.8 to a Local File Inclusion flaw triggered by the 'style' parameter in the hotel_alone_load_more_post function. An unauthenticated attacker can cause the theme to include and execute arbitrary files on the server, enabling them to run any PHP code. This can lead to bypassing access controls, exfiltrating sensitive data, or establishing persistent remote code execution if PHP files can be uploaded or included.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical severity, while the EPSS score of <1% indicates a very low probability of exploitation despite the high impact. The exploit does not currently appear in the CISA KEV catalog. Attackers can trigger the flaw through a simple unauthenticated web request to the vulnerable function, so the attack vector is remote network access to the affected site."}}}}, "created": "2026-04-20T23:45:21.601127+00:00", "updated": "2026-04-29T01:15:44.721769+00:00", "vendors": []}