Executive brief
The WP Travel Engine plugin for WordPress, which is used to manage travel and tour bookings, contains a security flaw that allows unauthorized visitors to modify site settings. Specifically, an attacker can change or delete the 'difficulty level' labels displayed on trip listings across the website. While this does not directly expose customer data, it allows for unauthorized content modification and can disrupt the site's professional appearance and operational accuracy.
Technical details
The vulnerability is a missing authorization check (CWE-862) in the 'wte_set_difficulty_term_level' AJAX action. The plugin relies on a public nonce ('wpxhr') that is served to anonymous visitors in front-end localized script data. Because there is no server-side capability check (such as current_user_can('manage_options')), an unauthenticated attacker can harvest the nonce and session cookie to send a crafted POST request. This allows the attacker to add, overwrite, or remove entries in the 'difficulty_level_by_terms' option, leading to unauthorized modification of site-wide configuration data. The issue is fixed in version 6.8.2.
Affected products
- WP Travel Engine WP Travel Engine < 6.8.2
Timeline
- 2026-07-13: disclosed: Initial public disclosure by researcher
- 2026-07-30: advisory: CVE published to NVD