WordPress Plugin Vulnerabilities

LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

Description

The plugin does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the plugin's shortcodes.

Proof of Concept

Affects Plugins

Plugin icon
logmytrip
No known fix

References

CVE
CVE-2026-16572

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
8.6 (high)

Miscellaneous

Original Researcher
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter
Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso
Submitter website
https://telefonica.com
Verified
Yes
WPVDB ID
2d9b816c-25b3-427f-ad72-f9812d9aa86d

Timeline

Publicly Published
2026-07-24 (about 10 days ago)
Added
2026-07-24 (about 9 days ago)
Last Updated
2026-07-31 (about 2 days ago)

Other

Published
Title
Published
2025-07-01
Title
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'
Published
2025-01-20
Title
Social Share, Social Login and Social Comments Plugin – Super Socializer < 7.14.1 - Unauthenticated Limited SQL Injection via 'SuperSocializerKey'
Published
2024-11-04
Title
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons < 24.0.4 - Unauthenticated SQL Injection
Published
2025-04-09
Title
Duplicate Title Checker <= 1.2 - Authenticated (Subscriber+) SQL Injection
Published
2025-08-27
Title
Nest Addons < 1.6.4 - Unauthenticated SQL Injection