What is GHSA-qj2j-73pj-4fxf?

GHSA-qj2j-73pj-4fxf is a security advisory published by GitHub Security Advisories with unknown severity. The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a...

Which CVE IDs does GHSA-qj2j-73pj-4fxf cover?

GHSA-qj2j-73pj-4fxf covers the following CVE IDs: CVE-2026-10834. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-qj2j-73pj-4fxfunknown

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a...

Vendor

GitHub Security Advisories

Published

July 7, 2026

Last Modified

July 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-10834 →

📋 Description

The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-10834
https://wpscan.com/vulnerability/5b939f98-0fbd-4f89-9948-77dbcc67f9d3
https://github.com/advisories/GHSA-qj2j-73pj-4fxf