EUVD-2026-52186
GHSA-q8gv-w79g-jw6j
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Network-delivered via cookie, no auth needed (PR:N), scope changes to DB tier (S:C); MySQL stacked-query restriction limits impact to confidentiality only (I:N, A:N).
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.
AnalysisAI
SQL injection in the LogMyTrip WordPress plugin (≤1.9) lets unauthenticated remote attackers extract data from the underlying WordPress database by injecting malicious SQL through an unsanitized cookie value on any page rendering a plugin shortcode. A proof-of-concept is publicly available via WPScan, and the CVSS Scope:Changed rating reflects the injection crossing the application boundary into the database tier. Despite high CVSS (8.6) and a public exploit, EPSS sits at 0.19% (9th percentile) and SSVC records no observed exploitation, suggesting limited real-world targeting consistent with this plugin's niche footprint.
Technical ContextAI
CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) is the root cause: the plugin reads a value directly from an HTTP cookie and passes it into a SQL query - almost certainly via WordPress's $wpdb interface - without using parameterized queries or $wpdb->prepare(), which is the standard WordPress defense. The vulnerability activates on any page that renders one of the plugin's shortcodes, meaning the attack surface scales with site layout. CPE cpe:2.3:a:unknown:logmytrip:*:*:*:*:*:*:*:* (vendor field 'unknown') indicates this is a small, likely solo-maintained plugin not catalogued by NVD with a known vendor identifier. MySQL, the WordPress database backend, does not support stacked queries via PHP's MySQLi in default configurations, which constrains this to read-only data exfiltration techniques (UNION-based, blind/time-based) rather than arbitrary write operations - consistent with the CVSS C:H/I:N/A:N assignment.
RemediationAI
No specific fixed version is identified in the available intelligence data; the WPScan advisory at https://wpscan.com/vulnerability/2d9b816c-25b3-427f-ad72-f9812d9aa86d/ should be checked immediately for patch availability, as WPScan typically coordinates disclosure with plugin maintainers. Until a patched version is confirmed, the safest action is to deactivate and uninstall the LogMyTrip plugin from all WordPress installations - this eliminates the attack surface entirely with no functional trade-off for unneeded functionality. As a targeted compensating control, a WAF rule inspecting cookie header values for SQL metacharacters (single quotes, UNION, SELECT, comment sequences) can reduce exploitation success without removing the plugin, though WAF evasion by a motivated attacker remains possible. Restricting pages containing LogMyTrip shortcodes to authenticated WordPress users via access-control plugins would remove the unauthenticated attack vector (CVSS PR:N) but requires shortcode pages not be publicly accessible, which may conflict with the plugin's intended public-facing travel-log use case.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today