What is the CVSS score of CVE-2026-24367?

CVE-2026-24367 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Wordpress Theme are affected by CVE-2026-24367?

A critical SQL injection vulnerability in the Traveler plugin (versions before 3.2.8) allows attackers to extract sensitive data through blind SQL injection attacks.

How to fix or mitigate CVE-2026-24367?

Within 24 hours: Identify all systems running Traveler plugin and document versions in use; isolate affected instances from production if possible. Within 7 days: Implement WAF rules to block SQL injection patterns; apply input validation and output encoding controls; monitor database logs for suspicious queries. Within 30 days: Upgrade to Traveler 3.2.8 or later once patch is released; conduct vulnerability scan and penetration testing post-remediation.

Wordpress Theme CVE-2026-24367

HIGH

SQL Injection (CWE-89)

2026-01-22 audit@patchstack.com

WordPress SQLi Wordpress Theme

8.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.8 (HIGH) 8.5 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 8.8

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.

AnalysisAI

Blind SQL injection in shinetheme Traveler versions before 3.2.8 enables authenticated attackers to extract sensitive database information through manipulated SQL queries. An attacker with valid credentials can exploit this vulnerability to read, modify, or delete arbitrary data with no user interaction required. No patch is currently available.

Technical ContextAI

Classified as CWE-89 (SQL Injection). Affects shinetheme Traveler traveler. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.8.

Affected ProductsAI

Product: shinetheme Traveler traveler.

RemediationAI

Monitor vendor advisories for a patch. Use parameterized queries. Implement input validation. Restrict network access to the affected service where possible.