# CVE-2026-12500: WP Travel Engine missing authorization in difficulty level update

Source: https://junglewise.ai/threats/cve-2026-12500-wp-travel-engine-missing-authorization-in-difficulty-level-update  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-30. Updated: 2026-07-30  
License: CC BY 4.0 with a link back

CVE-2026-12500 · Severity: info · CVSS 5.3 · Published 2026-07-30

The WP Travel Engine plugin for WordPress, which is used to manage travel and tour bookings, contains a security flaw that allows unauthorized visitors to modify site settings. Specifically, an attacker can change or delete the 'difficulty level' labels displayed on trip listings across the website. While this does not directly expose customer data, it allows for unauthorized content modification and can disrupt the site's professional appearance and operational accuracy.

Technologies: [WP Travel Engine](https://junglewise.ai/threats/technologies/wp-travel-engine). Vendors: [WP Travel Engine](https://junglewise.ai/threats/vendors/wp-travel-engine).

## Quick answers

**Is CVE-2026-12500 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12500 being exploited in the wild.

**How severe is CVE-2026-12500?** Informational severity, with a CVSS score of 5.3, published 30 July 2026.

**Which products and versions are affected?** WP Travel Engine < 6.8.2.

**Is there a fix for CVE-2026-12500?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12500 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-12500?** Check whether you run WP Travel Engine at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check (CWE-862) in the 'wte_set_difficulty_term_level' AJAX action. The plugin relies on a public nonce ('wpxhr') that is served to anonymous visitors in front-end localized script data. Because there is no server-side capability check (such as current_user_can('manage_options')), an unauthenticated attacker can harvest the nonce and session cookie to send a crafted POST request. This allows the attacker to add, overwrite, or remove entries in the 'difficulty_level_by_terms' option, leading to unauthorized modification of site-wide configuration data. The issue is fixed in version 6.8.2.

## Affected products

- WP Travel Engine WP Travel Engine < 6.8.2

## Timeline

- 2026-07-13: disclosed: Initial public disclosure by researcher
- 2026-07-30: advisory: CVE published to NVD

## References

- [https://wpscan.com/vulnerability/10b52de8-c1a8-4b58-9445-737d43033704/](https://wpscan.com/vulnerability/10b52de8-c1a8-4b58-9445-737d43033704/)

## Related threats

- [WP Travel Engine unauthenticated IDOR in booking cart actions](https://junglewise.ai/threats/cve-2026-16737-wp-travel-engine-unauthenticated-idor-in-booking-cart-actions)
- [WP Travel Engine arbitrary file move via user_profile_image](https://junglewise.ai/threats/cve-2026-10834-wp-travel-engine-arbitrary-file-move-via-user-profile-image)
- [WP Travel Engine PHP object injection](https://junglewise.ai/threats/cve-2026-49770-wp-travel-engine-php-object-injection)
- [WP Travel Engine improper input validation in WordPress plugin](https://junglewise.ai/threats/cve-2026-49078-wp-travel-engine-improper-input-validation-in-wordpress-plugin)
- [WP Travel Engine Stored XSS in wte_trip_tax shortcode](https://junglewise.ai/threats/cve-2026-2437-wp-travel-engine-stored-xss-in-wte-trip-tax-shortcode)