CVE-2026-93947
CriticalCVSS 9.3Summary
The Traveler plugin (up to version 3.2.9) contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to perform a Blind SQL Injection attack.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to or modify database data, potentially leading to the exposure of sensitive information.
Recommendation
Update the Traveler plugin to the latest version that fixes the vulnerability. If an update is not possible, consider disabling the plugin until it is patched.
Other vulnerabilities in Traveler
See all- CVE-2025-67917Medium
Missing Authorization vulnerability in shinetheme Traveler allows exploiting incorrectly configured access control security levels. This issue affects Traveler from n/a through <= 3.2.6.
- CVE-2025-63028Medium
The Traveler theme contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 3.2.6.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS