EUVD-2026-95635
GHSA-3rhj-j5m7-5p66
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Network-reachable low-complexity blind SQLi reading DB data gives AV:N/AC:L/C:H; accepting the reported PR:N (unauthenticated), with S:C and I:N/A:L consistent with read-oriented injection.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
AnalysisAI
Unauthenticated blind SQL injection in the Shinetheme Traveler WordPress theme (all versions from initial release through 3.2.9) lets a network-based attacker inject arbitrary SQL into a vulnerable query and infer database contents through boolean- or time-based responses, yielding high confidentiality impact with no integrity or availability loss of note. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describes a low-complexity, no-authentication, no-user-interaction attack with a scope change, indicating the vulnerable component can affect resources beyond its own security boundary - such as the underlying WordPress database. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target WordPress site to have the Shinetheme Traveler theme installed and active at version 3.2.9 or earlier, with the vulnerable (unspecified) parameter/endpoint reachable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input provides a strong CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L, base 9.3) describing a network-reachable, low-complexity, unauthenticated blind SQL injection with a scope change and high confidentiality impact - on paper a high-priority flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the fix state must be confirmed at the Patchstack advisory (https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-2-9-sql-injection-vulnerability?_s_id=cve) before assuming an upgrade target; do not treat 3.2.9 as fixed, since it is the last affected version and the remediated release number is not stated. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, enumerate every WordPress instance running the Shinetheme Traveler theme, confirm version numbers, and mark any installation at or below 3.2.9 as exposed; where these sites are internet-facing and hold regulated or customer data, deploy WAF virtual-patching rules targeting SQL-injection patterns in theme query parameters and temporarily restrict or take offline the most sensitive deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via t
A critical PHP object injection vulnerability exists in the Shinetheme Traveler WordPress theme due to insecure deserial
IBM Traveler 8.x and 9.x before 9.0.1.12 allows remote authenticated users to read arbitrary files or cause a denial of
HCL Traveler contains a weak default HTTP header validation vulnerability (CWE-346) that allows authenticated attackers
The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. Rated medium severity (CVSS 5.4),
There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf). Rated medium
HCL Traveler contains a sensitive information disclosure vulnerability where error messages expose internal system detai
HCL Traveler's Apple profile generation page reflects user-submitted Logon Name and Mail Address values into generated A
HCL Traveler generates some error messages that provide detailed information about errors and failures, such as internal
HCL Traveler is affected by an internal path disclosure in a Windows application when the application inadvertently reve
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today