CVE-2026-16572 PUBLISHED

LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

Assigner: WPScan
Reserved: 22.07.2026 Published: 03.08.2026 Updated: 03.08.2026

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

Product Status

Vendor Unknown
Product LogMyTrip
Versions Default: unknown
  • affected from 0 to 1.9 (incl.)

Credits

  • Pablo González Pérez finder
  • Francisco José Ramírez Vicente and Iñigo Sánchez Enciso finder
  • WPScan coordinator

References

Problem Types

  • CWE-89 SQL Injection CWE