CVE-2026-12500

WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update

High · published July 30, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
28.3
In the wild
Unconfirmed
What it is

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00358 · 28.3th percentile
Published
2026-07-30T06:00Z
EPSS history
Timeline
  • 30 JUL 06:00Z
    WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
    cvelistv5