WP Travel Engine Plugin Lacks AJAX Capability Verification

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option (the public nonce that gates the action is served to anonymous visitors).

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP Travel Engine WordPress plugin before version 6.8.2 contains a critical authorization bypass vulnerability where an AJAX action fails to verify user capabilities before allowing option updates. While the vulnerable endpoint uses a nonce for CSRF protection, this nonce is publicly available to unauthenticated visitors, enabling attackers to modify site-wide plugin settings without authentication. This vulnerability affects WordPress installations using the affected plugin versions and could allow threat actors to alter travel engine configurations, potentially redirecting bookings, modifying pricing, or injecting malicious content into the travel booking workflow. Organizations relying on this plugin for e-commerce or travel booking functionality face risks of business logic manipulation and data integrity compromise.

Casky's skill mapping identifies this vulnerability pattern across 283 security techniques, with primary alignment to MITRE ATT&CK TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would detect attack patterns including: unauthorized AJAX requests modifying plugin options without proper role-based access controls (CWE-862: Missing Authorization), nonce validation that creates false security by serving identical tokens to anonymous users, and capability check bypass attempts in WordPress plugin hooks. Claude's extended reasoning would surface the critical distinction between CSRF protection (nonce presence) and authorization enforcement (capability checks), helping teams understand why attackers can exploit this endpoint despite apparent security measures. Security findings would flag unauthenticated AJAX actions, improper reliance on nonce-only security models, and the lack of `current_user_can()` validation as high-risk patterns requiring immediate plugin updates and Web Application Firewall rules to restrict unauthorized option modifications.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12500.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-12500

Casky has 283 skills that investigate the attack patterns behind CVE-2026-12500. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn