What is the CVSS score of CVE-2026-45218?

CVE-2026-45218 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WP Travel are affected by CVE-2026-45218?

CVE-2026-45218 is a blind SQL injection vulnerability in WP Travel plugin (≤11.4.0) that allows authenticated users with low-level WordPress privileges to extract sensitive database contents,…

WP Travel CVE-2026-45218

Q: How to fix or mitigate CVE-2026-45218?

Within 24 hours: Identify all WordPress instances running WP Travel plugin ≤11.4.0 using automated scanning or manual theme/plugin audit; disable the plugin if not immediately required for operations. Within 7 days: Contact WP Travel vendor (Patchstack) for patch timeline and monitor advisory channels daily for release announcements; implement network-level access restrictions to WordPress admin panels limiting low-privilege user accounts. Within 30 days: Apply vendor-released patch immediately upon availability to all affected installations, or migrate to alternative travel booking plugin if vendor patch timeline exceeds risk tolerance; audit database access logs for SQL injection patterns since deployment date.

EUVD-2026-29458 HIGH

SQL Injection (CWE-89)

2026-05-12 Patchstack

GHSA-w43m-mxfg-9r8c

SQLi

7.7

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 11:32 vuln.today

CVE Published

May 12, 2026 - 11:02 nvd

HIGH 7.7

DescriptionNVD

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This issue affects WP Travel: from n/a through <= 11.4.0.

AnalysisAI

Blind SQL injection in WP Travel plugin versions ≤11.4.0 allows authenticated attackers with low-level privileges to extract sensitive database contents through time-based or boolean queries. The vulnerability enables cross-scope confidentiality breach with high impact (CVSS:C:H), permitting unauthorized access to all WordPress database information including user credentials, private travel booking details, and payment data. …

RemediationAI

Within 24 hours: Identify all WordPress instances running WP Travel plugin ≤11.4.0 using automated scanning or manual theme/plugin audit; disable the plugin if not immediately required for operations. Within 7 days: Contact WP Travel vendor (Patchstack) for patch timeline and monitor advisory channels daily for release announcements; implement network-level access restrictions to WordPress admin panels limiting low-privilege user accounts. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-45218 vulnerability details – vuln.today

Back

WP Travel CVE-2026-45218

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code