CVE-2025-1771 is a critical Local File Inclusion vulnerability in the Traveler WordPress theme (versions up to 3.1.8) by ShineTheme. It arises from improper control of the filename used in an include/require statement within the 'hotel_alone_load_more_post' function's 'style' parameter. This allows unauthenticated attackers to include arbitrary files on the server, enabling execution of arbitrary PHP code. The vulnerability can lead to full system compromise including bypassing access controls and data exposure. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix is currently available, and the product is not a cloud service.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary PHP code on the affected server by including malicious files. This can result in complete system compromise, including bypassing access controls, unauthorized data access, and disruption of service. The vulnerability's critical CVSS score (9.8) reflects its high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable 'hotel_alone_load_more_post' functionality if possible, restrict file upload capabilities to prevent uploading PHP files, and apply other compensating controls such as web application firewalls to detect and block exploitation attempts.