WordPress LogMyTrip plugin <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie vulnerability

Unauthenticated SQL Injection via 'tid' Cookie vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin LogMyTrip versions = 1.9...

CVE-2026-16572

The LogMyTrip WordPress plugin (versions up to 1.9) is affected by an unauthenticated SQL injection via the tid cookie. The root cause is failure to sanitize and escape a value taken from a cookie before it is used in a SQL query on pages that render the plugin’s shortcodes. Impact is high for co...

CVE-2026-16572 LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes...