CVE-2026-12500— WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
Quick assessment
Affected
Unknown WP Travel Engine
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WP Travel Engine是WP Travel Engine公司的一款专注于旅游行业的WordPress插件产品。 WordPress WP Travel Engine 6.8.2之前版本存在授权问题漏洞，该漏洞源于未对更新选项的AJAX操作进行能力检查，允许未认证用户覆盖站点范围的选项。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | WP Travel Engine | < 6.8.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-12500
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
WordPress WP Travel Engine 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WP Travel Engine是WP Travel Engine公司的一款专注于旅游行业的WordPress插件产品。 WordPress WP Travel Engine 6.8.2之前版本存在授权问题漏洞，该漏洞源于未对更新选项的AJAX操作进行能力检查，允许未认证用户覆盖站点范围的选项。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Travel Engine | 0 ~ 6.8.2 | - |
|
II. Public POCs for CVE-2026-12500
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-12500
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-12500 (1)
-
🔗 WP Travel Engine < 6.8.2 – Unauthenticated Trip Difficulty Level Option Update | CVE 2026-12500 | Plugin Vulnerabilities Read full article exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-07-30 · 36 CVEs total
| CVE-2026-13145 | WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR | |
| CVE-2026-15257 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile Modificatio | |
| CVE-2026-15240 | Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrat | |
| CVE-2026-15382 | Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Dele | |
| CVE-2026-11870 | Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Prote | |
| CVE-2026-11867 | Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/De | |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | |
| CVE-2026-11782 | Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Poin | |
| CVE-2026-13143 | WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN | |
| CVE-2026-15255 | RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR | |
| CVE-2026-13344 | Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table | |
| CVE-2026-13330 | Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload | |
| CVE-2026-13345 | Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce | |
| CVE-2026-13178 | Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation | |
| CVE-2026-13395 | Bookly < 27.8 - Unauthenticated SQL Injection via staff_id | |
| CVE-2026-14310 | Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection | |
| CVE-2026-14239 | Tourmaster < 5.4.8 - Stored XSS via CSRF | |
| CVE-2026-14305 | WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likes | |
| CVE-2026-15235 | Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX | |
| CVE-2026-14188 | Easy Appointments < 3.12.28 - Contributor+ Customer Data Disclosure |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Travel Engine
-
CVE-2026-16737
WP Travel Engine < 6.8.5 - Unauthenticated Booking Details D -
CVE-2026-12501
WP Travel Engine < 6.8.2 - Unauthenticated Payment Bypass vi -
CVE-2026-10834
WP Travel Engine < 6.8.1 - Subscriber+ Arbitrary Media File -
CVE-2026-49770
WordPress WP Travel Engine plugin <= 6.7.12 - PHP Object Inj -
CVE-2026-49078
WordPress WP Travel Engine plugin <= 6.7.10 - Other Vulnerab
Same vendor: Unknown
-
CVE-2026-77115
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS -
CVE-2026-77116
Brave Popup Builder < 0.8.6 - Subscriber+ Unpublished Popup -
CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capabilit -
CVE-2026-14853
WooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Pr -
CVE-2026-13598
RestrictMate < 1.3.0 - Unauthenticated Privilege Escalation
V. Comments for CVE-2026-12500
No comments yet