Unauthorized Option Overwrite in WP Travel Engine Plugin for WordPress
CVE-2026-12500

Currently unrated

Key Information:

Vendor

WordPress
Status
WP Travel Engine
Vendor
CVE Published:
30 July 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-12500?

The WP Travel Engine plugin for WordPress prior to version 6.8.2 is vulnerable due to insufficient access checks on AJAX actions. This flaw allows unauthenticated users to execute certain actions, specifically overwriting critical site-wide options, as the public nonce required for these actions is accessible to anonymous visitors. Without proper validation mechanisms in place, this vulnerability poses a significant risk, enabling potential attackers to manipulate configurations that could affect site integrity and functionality.

Affected Version(s)

WP Travel Engine 0 < 6.8.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-12500 - Proof of Concept

References

https://wpscan.com/vulnerability/10b52de8-c1a8-4b58-9445-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Meher Sudhakar Abbireddi
WPScan
.