{"id":"CVE-2026-93947","published":"2026-10-09T10:16:39.520","lastModified":"2026-10-09T16:17:32.090","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-2-9-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows attackers to perform blind SQL injection attacks against the Shinetheme Traveler plugin, potentially enabling them to extract data from the database through carefully crafted SQL commands. The flaw is critical because it can lead to full database compromise and data exfiltration.","exploitability":"Exploitation requires no authentication and can be performed remotely with minimal preconditions, making it highly practical for attackers to leverage.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive user data, including credentials and personal information, from the affected WordPress site's database.","remediation":"Upgrade to Traveler version 3.2.10 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","web","blind-sql"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:51:32.721Z"}}