SQL Injection Vulnerability in LogMyTrip WordPress Plugin
CVE-2026-16572
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-16572?
The LogMyTrip plugin for WordPress, up to version 1.9, is susceptible to SQL injection attacks due to its failure to properly sanitize and escape user input taken from cookies before incorporating it into SQL queries. This vulnerability permits unauthenticated users to manipulate the database through any page that utilizes the plugin's shortcodes, posing a significant risk to the integrity and confidentiality of the site's data.
Affected Version(s)
LogMyTrip 0 <= 1.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.