The vulnerability CVE-2025-30891 in magepeopleteam WpTravelly arises from improper validation of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, which can be exploited by an attacker with low privileges to include unintended files, potentially leading to remote code execution or disclosure of sensitive information. The issue affects WpTravelly versions up to 1.8.7. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, requiring low privileges, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including execution of arbitrary code, disclosure of sensitive data, and disruption of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from magepeopleteam regarding WpTravelly. Until a fix is available, restricting access to the affected plugin and limiting privileges may reduce risk.