CVE-2024-12272 is a Local File Inclusion vulnerability (CWE-98) in the WP Travel Engine – Elementor Widgets plugin for WordPress, affecting all versions up to 1.3.7. The vulnerability arises from improper control of filenames used in include/require statements, enabling authenticated attackers with Contributor-level privileges or higher to include arbitrary files on the server. This can lead to remote code execution by executing PHP code contained in those files. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows attackers with Contributor-level access to execute arbitrary PHP code on the server, bypass access controls, and access sensitive data. This can lead to full compromise of the affected WordPress site, including data theft, site defacement, or further pivoting within the hosting environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity. Avoid uploading untrusted files and consider disabling vulnerable widgets if possible.