Backpacktraveler Vulnerabilities

[en] Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.

Affected:

up to 2.10.3

Fix:

No patched version reported

Disclosed:

Dec 30, 2025

CVE-2025-69030 on NVD →

The Backpack Traveler - Modern Travel Blog WordPress Theme theme for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.10.3 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVSS:

4.3

Affected:

up to 2.10.3

Fix:

No patched version reported

Disclosed:

Dec 29, 2025

CVE-2025-69030 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler allows PHP Local File Inclusion. This issue affects Backpack Traveler: from n/a through 2.7.

Affected:

up to 2.7

Fix:

No patched version reported

Disclosed:

May 23, 2025

CVE-2025-39490 on NVD →

The Backpack Traveler theme for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.10.2. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access co...

CVSS:

9.8

Affected:

up to 2.10.2

Fixed in:

2.10.3

Disclosed:

May 21, 2025

CVE-2025-39490 on NVD →