CVE-2026-16572 — LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

CVE-2026-16572

LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie PUBLISHED

Description (CNA)

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

Affected (CNA)

Vendor / product	Versions
Unknown / LogMyTrip	affected 0 through 1.9

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2d9b816c-25b3-427f-ad72-f9812d9aa86d/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.