CVE-2026-10834 is a path manipulation vulnerability in the WP Travel Engine WordPress plugin versions prior to 6.8.1. The plugin does not properly validate the source path of a user-supplied profile image before moving the file. Authenticated users with subscriber-level permissions or higher can exploit this to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This action removes the original media files from their locations, which can disrupt site content that relies on those files. The vulnerability is classified under CWE-73, indicating external control of file name or path. No official patch or remediation level has been confirmed in the provided data.

The vulnerability allows authenticated users with low-level privileges (subscriber and above) to move arbitrary files within the uploads directory, which can lead to broken media links and disrupted site content. There is no indication of confidentiality or integrity compromise beyond file relocation. Availability impact is limited to potential content breakage. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions before 6.8.1, upgrading to version 6.8.1 or later (if available) is recommended once confirmed. Until an official fix is released, restrict user permissions where possible and monitor for unusual file movements within the uploads directory.