What is the CVSS score of CVE-2026-12500?

CVE-2026-12500 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of WP Travel Engine are affected by CVE-2026-12500?

WP Travel Engine WordPress plugin versions before 6.8.2 contain a vulnerability in AJAX functionality that lacks proper capability checks, enabling attackers to tamper with site-wide plugin settings.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12500?

Yes, a public proof-of-concept exploit is available for CVE-2026-12500. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12500?

Within 24 hours, verify your WP Travel Engine plugin version in WordPress admin dashboard and immediately update to version 6.8.2 or later via the WordPress plugin management interface or vendor download. Over the next 7 days, conduct testing of core travel booking functionality to ensure the patch resolves the vulnerability without breaking existing features. Within 30 days, review your WordPress security monitoring to confirm no unauthorized plugin settings modifications occurred during the window before patching, and implement additional access controls to restrict plugin settings management.

WP Travel Engine CVE-2026-12500

EUVD-2026-51006 HIGH

Missing Authorization (CWE-862)

2026-07-30 WPScan

GHSA-jfwf-348v-33wp

WordPress Authentication Bypass Wp Travel Engine

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network AJAX action with no user interaction (PR:N/UI:N/AV:N/AC:L); overwriting a site-wide option is an integrity impact only, so C:N/I:H/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:46 vuln.today

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

AnalysisAI

Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper with a site-wide plugin setting because an AJAX action lacks a capability check and the nonce that gates it is served to logged-out users. Attackers do not need credentials; publicly available exploit code exists, though EPSS remains low (0.15%, 4th percentile) and the flaw is not on CISA KEV. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Load public page and scrape plugin nonce

Delivery

POST crafted action to admin-ajax.php

Exploit

Bypass missing capability check

Execution

Overwrite site-wide plugin option

Impact

Alter plugin behavior / integrity impact

Access

Load public page and scrape plugin nonce

Delivery

POST crafted action to admin-ajax.php

Exploit

Bypass missing capability check

Execution

Overwrite site-wide plugin option

Impact

Alter plugin behavior / integrity impact

Vulnerability AssessmentAI

Exploitation	Exploitation requires only that the WP Travel Engine plugin (version below 6.8.2) be installed and active on a reachable WordPress site; the attacker must first retrieve the public nonce, which the plugin serves to anonymous visitors, then replay it to the unprotected AJAX action on admin-ajax.php. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, 7.5 High) is internally consistent with the description: network reachable, low complexity, no privileges, no user interaction, and an integrity-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker loads a public page of a target site, scrapes the plugin's public nonce embedded in the response, then sends a crafted POST to /wp-admin/admin-ajax.php invoking the vulnerable action with that nonce to overwrite the site-wide plugin option - all without logging in. Because publicly available exploit code exists and SSVC rates the attack automatable, this can be scripted and fired at many sites indiscriminately.
Remediation	Vendor-released patch: upgrade the WP Travel Engine plugin to version 6.8.2 or later, which adds the missing capability check on the affected AJAX action. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, verify your WP Travel Engine plugin version in WordPress admin dashboard and immediately update to version 6.8.2 or later via the WordPress plugin management interface or vendor download. …

Threat intelligence, references, and detailed analysis are available after sign-in.