CVE-2026-49770 Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions

Description

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

Affected products and versions

Product	Affected versions	Fixed in
WP Travel Engine 6.7	earliest → 6.7.12	No fix stated

Other CVEs of WP Travel Engine

The 10 CVEs of WP Travel Engine →

CVE-2026-49078 Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions 7.5 High CVE-2025-59574 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel Engine… 6.5 Medium CVE-2025-49308 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in… 7.5 High CVE-2025-30870 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in… 8.1 High