An AJAX endpoint in the WP Travel Engine plugin before version 6.8.2 does not perform a capability check when updating site-wide options. This flaw enables anyone on the Internet to send a crafted request and overwrite configuration settings such as the trip difficulty level. The vulnerability does not provide remote code execution or access to privileged accounts; it simply allows unauthenticated users to modify plugin behavior that can affect booking flows and business logic.

WordPress sites that have the WP Travel Engine plugin installed with a version older than 6.8.2. The affected component is the AJAX action that modifies the public option storage. The exact versions are inferred from the description rather than explicitly stated.

The CVSS score of 7.5 classifies this as a high‑severity issue. The EPSS score of less than 1 % indicates a low likelihood that this vulnerability is actively exploited. It is not listed in the CISA KEV catalog. Because no authentication is required and the public nonce is returned to anonymous visitors, the attack can be performed from any network without prior compromise. Even though exploitation probability is low, the possible impact on the integrity of site configuration warrants urgent attention.