CVE-2026-93947
9.3 CRITICALPublished 2026-10-09 · Updated 2026-10-09
AI risk analysis
- Summary
- This vulnerability allows attackers to perform blind SQL injection attacks against the Shinetheme Traveler plugin, potentially enabling them to extract data from the database through carefully crafted SQL commands. The flaw is critical because it can lead to full database compromise and data exfiltration.
- Exploitability
- Exploitation requires no authentication and can be performed remotely with minimal preconditions, making it highly practical for attackers to leverage.
- Blast radius
- If exploited, this vulnerability could allow attackers to extract sensitive user data, including credentials and personal information, from the affected WordPress site's database.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Traveler version 3.2.10 or later to remediate this SQL injection vulnerability.
sql-injectionwordpresswebblind-sql
Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
Weaknesses
CWE-89
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2026-96330
- HIGHCVE-2022-4997
- HIGHCVE-2026-102379
- HIGHCVE-2026-103066
- HIGHCVE-2026-103338
- CRITICALCVE-2026-103352
- CRITICALCVE-2026-103355
- HIGHCVE-2026-105076
Related by shared AI tags and CWE weakness class. Browse the full archive.