CVE-2026-12500

The CVE-2026-12500 affects the WordPress plugin WP Travel Engine prior to version 6.8.2 . It lacks a capability check on an AJAX action that updates a plugin option, allowing unauthenticated users to overwrite a site-wide option (the action is gated by a public nonce served to anonymous visitors)...