What is the CVSS score of CVE-2026-54808?

CVE-2026-54808 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of WP Travel Gutenberg Blocks are affected by CVE-2026-54808?

WP Travel Gutenberg Blocks plugin (versions ≤3.9.4) contains a critical database vulnerability allowing remote attackers to extract sensitive data from WordPress installations without authentication.

How to fix or mitigate CVE-2026-54808?

Within 24 hours: Audit all WordPress installations for WP Travel Gutenberg Blocks up to version 3.9.4; disable the plugin immediately if business operations permit replacement. Within 7 days: Implement database-level access controls (read-only permissions on affected tables) and deploy WAF rules to block SQL injection patterns; begin evaluation of alternative travel-booking solutions. Within 30 days: Monitor Patchstack and WordPress plugin repository for patched versions (≥3.9.5); maintain plugin deactivation status until patch is released, tested, and deployed.

WP Travel Gutenberg Blocks CVE-2026-54808

CRITICAL

SQL Injection (CWE-89)

2026-06-17 Patchstack

WordPress SQLi Wp Travel Wordpress Plugin Wp Travel Gutenberg Blocks

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.4 CRITICAL

Unauthenticated network SQLi against a WordPress plugin endpoint warrants AV:N/AC:L/PR:N/UI:N; blind SQLi typically permits read and write to the DB so C:H/I:H, with no scope change since impact stays within the WordPress DB trust boundary.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:26 vuln.today

DescriptionCVE.org

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel Gutenberg Blocks allows Blind SQL Injection.

This issue affects WP Travel Gutenberg Blocks: from n/a through 3.9.4.

AnalysisAI

Blind SQL injection in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows remote unauthenticated attackers to inject arbitrary SQL into backend queries, exfiltrating data from the WordPress database via inference-based techniques. The CVSS 9.3 score reflects a scope-changed impact (S:C) where database compromise affects components beyond the plugin itself, though no public exploit identified at time of analysis. The vulnerability was reported by Patchstack and impacts WordPress sites running this travel-booking block plugin in default configurations.

Technical ContextAI

WP Travel Gutenberg Blocks is a WordPress plugin from WP Travel that adds Gutenberg editor blocks for displaying travel/tour content, integrating with the broader WP Travel booking ecosystem. The root cause class is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controlled input is concatenated into SQL queries without proper sanitization or parameterization - typically a failure to use WordPress's $wpdb->prepare() with placeholders, or use of esc_sql() in contexts where it is insufficient. The 'blind' qualifier indicates results are not directly reflected in HTTP responses, requiring boolean-based or time-based inference. The affected CPE cpe:2.3:a:wp_travel:wp_travel_gutenberg_blocks covers all versions through 3.9.4.

RemediationAI

Patch available per vendor advisory - upgrade WP Travel Gutenberg Blocks to a version newer than 3.9.4 once the fixed release is published by WP Travel; consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-travel-blocks/vulnerability/wordpress-wp-travel-gutenberg-blocks-plugin-3-9-4-sql-injection-vulnerability for the exact fixed version. If immediate patching is not possible, deactivate and remove the plugin until a fix is verified (trade-off: any travel/tour blocks rendered by it will break on the front end), or place the site behind a WAF with WordPress-specific SQLi rules such as Patchstack's mu-plugin protection or Wordfence (trade-off: signature gaps may permit blind boolean/time-based payloads, and WAF rules add request latency). As an additional compensating control, restrict database user privileges for the WordPress DB account to remove FILE, DROP, and cross-database access so that successful injection cannot pivot to host-level or other-schema impact.