What is the CVSS score of CVE-2026-12500?

CVE-2026-12500 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of WP Travel Engine are affected by CVE-2026-12500?

WP Travel Engine WordPress plugin versions before 6.8.2 contain a vulnerability in AJAX functionality that lacks proper capability checks, enabling attackers to tamper with site-wide plugin settings.. A patch is available.

Is there a public PoC exploit available for CVE-2026-12500?

Yes, a public proof-of-concept exploit is available for CVE-2026-12500. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-12500?

Within 24 hours, verify your WP Travel Engine plugin version in WordPress admin dashboard and immediately update to version 6.8.2 or later via the WordPress plugin management interface or vendor download. Over the next 7 days, conduct testing of core travel booking functionality to ensure the patch resolves the vulnerability without breaking existing features. Within 30 days, review your WordPress security monitoring to confirm no unauthorized plugin settings modifications occurred during the window before patching, and implement additional access controls to restrict plugin settings management.

WP Travel Engine CVE-2026-12500

EUVD-2026-51006 HIGH

Missing Authorization (CWE-862)

2026-07-30 WPScan

GHSA-jfwf-348v-33wp

WordPress Authentication Bypass Wp Travel Engine Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network AJAX action with no user interaction (PR:N/UI:N/AV:N/AC:L); overwriting a site-wide option is an integrity impact only, so C:N/I:H/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 30, 2026 - 18:46 vuln.today

Patch available

Jul 30, 2026 - 07:03 EUVD

CVE Published

Jul 30, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 30, 2026 - 06:00 cve.org

HIGH 7.5

DescriptionCVE.org

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

AnalysisAI

Unauthenticated option overwrite in the WP Travel Engine WordPress plugin before 6.8.2 lets any anonymous visitor tamper with a site-wide plugin setting because an AJAX action lacks a capability check and the nonce that gates it is served to logged-out users. Attackers do not need credentials; publicly available exploit code exists, though EPSS remains low (0.15%, 4th percentile) and the flaw is not on CISA KEV. Impact is integrity-only, with no direct data disclosure or denial of service.

Technical ContextAI

WP Travel Engine is a travel-booking and tour-package plugin for WordPress that stores its configuration in the WordPress options table. The vulnerability is a Missing Authorization weakness (CWE-862): an AJAX handler registered on the admin-ajax.php endpoint updates a persistent plugin option but never verifies the caller's capabilities (e.g. via current_user_can). Nonces in WordPress are intended as CSRF tokens, not authentication, and here the public nonce is rendered into pages delivered to anonymous visitors, so it provides no access control. The result is that the option-update path is reachable by any unauthenticated client that reads the nonce and replays it to admin-ajax.php. The CPE cpe:2.3:a:unknown:wp_travel_engine covers all versions of the plugin prior to the fixed release.

RemediationAI

Vendor-released patch: upgrade the WP Travel Engine plugin to version 6.8.2 or later, which adds the missing capability check on the affected AJAX action. Consult the WPScan advisory (https://wpscan.com/vulnerability/10b52de8-c1a8-4b58-9445-737d43033704/) for confirmation before and after updating. If you cannot immediately patch, compensating controls include restricting access to /wp-admin/admin-ajax.php for unauthenticated clients where feasible (note this can break legitimate front-end AJAX features of this and other plugins), deploying a WAF rule to block the specific vulnerable action parameter to admin-ajax.php, or temporarily disabling the plugin if the booking functionality is not in active use (which removes travel-booking features from the site). After patching, audit the affected site-wide option value for unauthorized changes and reset it if tampering is suspected.