LogMyTrip shortcode pages expose an unauthenticated SQL injection
LogMyTrip through 1.9 reads an attacker-controlled cookie value and uses it in a SQL query without sanitization or escaping. Any unauthenticated visitor can supply a malicious cookie to a page rendering one of the plugin's shortcodes and alter the resulting database query. The CNA record does not disclose the cookie name, shortcode, query, vulnerable function or obtainable database fields.
- Component
- LogMyTrip
- Plugin slug
logmytrip- Affected
- <= 1.9
- Safe version
> 1.9- Published
- Aug 03, 2026
This CVE was published Aug 03, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update to a corrected LogMyTrip release after 1.9 when available. Until then, remove affected shortcodes from public pages or replace the plugin, review requests carrying unusual cookie values and rotate exposed secrets if database extraction is suspected.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N