Quick answers
- Is CVE-2026-12500 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-12500 being exploited in the wild.
- How severe is CVE-2026-12500?
- Informational severity, with a CVSS score of 5.3, published 30 July 2026.
- Which products and versions are affected?
- WP Travel Engine < 6.8.2.
- Is there a fix for CVE-2026-12500?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-12500 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-12500?
- Check whether you run WP Travel Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the 'wte_set_difficulty_term_level' AJAX action. The plugin relies on a public nonce ('wpxhr') that is served to anonymous visitors in front-end localized script data. Because there is no server-side capability check (such as current_user_can('manage_options')), an unauthenticated attacker can harvest the nonce and session cookie to send a crafted POST request. This allows the attacker to add, overwrite, or remove entries in the 'difficulty_level_by_terms' option, leading to unauthorized modification of site-wide configuration data. The issue is fixed in version 6.8.2.
Affected products
- WP Travel Engine WP Travel Engine < 6.8.2
Timeline
- 2026-07-13: disclosed: Initial public disclosure by researcher
- 2026-07-30: advisory: CVE published to NVD