CVE-2026-12500

Vulnerability Description

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

Vulnerability Details

Published Date

July 30, 2026

Last Modified

July 30, 2026

Source

NVD

Vendor

Unknown

Product

WP Travel Engine

External References

https://wpscan.com/vulnerability/10b52de8-c1a8-4b58-9445-737d43033704/

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment