CVE-2026-12500: WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Travel Engine (WordPress plugin)to a version that resolves this vulnerability.Fixed in 6.8.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12500?
The severity of CVE-2026-12500 is rated as high with a CVSS score of 7.5.
How do I fix CVE-2026-12500?
To fix CVE-2026-12500, update the WP Travel Engine plugin to version 6.8.2 or later.
What type of attack does CVE-2026-12500 enable?
CVE-2026-12500 allows unauthenticated users to overwrite site-wide options in the WP Travel Engine plugin.
Which versions of WP Travel Engine are affected by CVE-2026-12500?
CVE-2026-12500 affects all versions of the WP Travel Engine plugin before 6.8.2.
Is authentication required to exploit CVE-2026-12500?
No, CVE-2026-12500 can be exploited by unauthenticated users.