CVE-2026-12500: WP Travel Engine Auth Bypass Vulnerability

CVE-2026-12500 Overview

CVE-2026-12500 affects the WP Travel Engine WordPress plugin in versions before 6.8.2. The plugin exposes an AJAX action that updates a site-wide plugin option without performing a capability check. The public nonce that gates the action is served to anonymous visitors, which negates its function as an authorization barrier. Unauthenticated attackers can overwrite plugin option values on any vulnerable site by replaying the AJAX request with the leaked nonce.

Critical Impact
Unauthenticated remote attackers can overwrite site-wide WP Travel Engine plugin options, altering plugin behavior and configuration on affected WordPress installations.

Affected Products

WP Travel Engine WordPress plugin versions prior to 6.8.2

Discovery Timeline

2026-07-30 - CVE-2026-12500 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-12500

Vulnerability Analysis

The vulnerability is a broken access control issue in the WP Travel Engine plugin's AJAX handler. The handler updates a persistent, site-wide plugin option but does not verify the caller's capabilities using current_user_can() or an equivalent authorization check. The only gate protecting the action is a WordPress nonce, and that nonce is embedded in output served to anonymous visitors.

Because the nonce is publicly available, it does not restrict who can call the action. Any unauthenticated visitor can harvest the nonce from a public page and submit an admin-ajax.php request that mutates plugin state. The result is unauthorized modification of stored configuration data belonging to the plugin.

The scope of impact depends on which option keys the handler accepts. Overwriting plugin configuration can influence how the plugin renders content, processes bookings, or integrates with other components. Refer to the WPScan Vulnerability Report for technical specifics.

Root Cause

The root cause is a missing capability check on a state-changing AJAX endpoint. The developer relied on nonce verification alone as an authorization control. Nonces in WordPress are anti-CSRF tokens, not authorization primitives, and become ineffective when exposed to anonymous users.

Attack Vector

An attacker retrieves the public nonce from a page rendered to anonymous visitors on the target site. The attacker then submits a crafted POST request to wp-admin/admin-ajax.php referencing the vulnerable action and the harvested nonce. The handler accepts the request and writes attacker-controlled values into the plugin option. No credentials, user interaction, or elevated privileges are required.

No verified proof-of-concept code is published in the CVE record. See the WPScan Vulnerability Report for further technical details.

Detection Methods for CVE-2026-12500

Indicators of Compromise

Unexpected changes to WP Travel Engine plugin option values in the wp_options table
POST requests to /wp-admin/admin-ajax.php from unauthenticated sources targeting WP Travel Engine actions
Repeated admin-ajax.php traffic from a single IP preceded by GETs to pages that embed the plugin's nonce

Detection Strategies

Compare current plugin option values against a known-good baseline and alert on drift
Inspect web server logs for anonymous POSTs to admin-ajax.php referencing WP Travel Engine action names
Enable audit logging of option updates in WordPress to attribute changes to a user context or lack thereof

Monitoring Recommendations

Alert on plugin option modifications occurring outside administrator sessions
Monitor for a spike in admin-ajax.php requests correlated with pages that render plugin content
Track file and database integrity for WordPress installations running WP Travel Engine

How to Mitigate CVE-2026-12500

Immediate Actions Required

Update the WP Travel Engine plugin to version 6.8.2 or later on all affected WordPress sites
Review the wp_options table for unauthorized changes to WP Travel Engine option keys and restore expected values
Rotate any credentials or API keys that may have been stored in plugin options if those options were modifiable

Patch Information

The vendor addressed CVE-2026-12500 in WP Travel Engine version 6.8.2. The fixed release adds a capability check to the affected AJAX handler so that only privileged users can update the plugin option. Administrators should apply the update through the WordPress plugin management interface or via WP-CLI.

Workarounds

Restrict access to /wp-admin/admin-ajax.php for unauthenticated users at the web application firewall for the vulnerable action name
Temporarily disable the WP Travel Engine plugin on sites that cannot be updated immediately
Apply virtual patching rules that reject POST requests to the vulnerable AJAX action from unauthenticated sessions

bash

# Update WP Travel Engine via WP-CLI
wp plugin update wp-travel-engine --version=6.8.2
wp plugin get wp-travel-engine --field=version