CVE-2026-16572: LogMyTrip WordPress Plugin SQLi Flaw

CVE-2026-16572 Overview

CVE-2026-16572 is an unauthenticated SQL injection vulnerability in the LogMyTrip WordPress plugin through version 1.9. The plugin fails to sanitize and escape a value taken from a cookie before using it in a SQL query. Any page that renders one of the plugin's shortcodes becomes an entry point for injection. Attackers can send crafted cookie values to extract data from the backend database without authentication or user interaction. The issue is tracked as CWE-89: SQL Injection and is documented in the WPScan Vulnerability Report.

Critical Impact
Unauthenticated attackers can inject arbitrary SQL statements through a cookie value on any public page that renders a LogMyTrip shortcode, enabling database contents disclosure.

Affected Products

LogMyTrip WordPress plugin, all versions through 1.9
WordPress sites that render LogMyTrip shortcodes on public pages
Any WordPress installation with the vulnerable plugin activated

Discovery Timeline

2026-08-03 - CVE-2026-16572 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-16572

Vulnerability Analysis

The vulnerability resides in the LogMyTrip plugin's shortcode rendering path. When a page containing a LogMyTrip shortcode is loaded, the plugin reads a value from a client-controlled cookie and passes it into a SQL query without sanitization or parameterization. Because cookies are attacker-controlled, any visitor can send arbitrary SQL fragments to the backend database.

Exploitation requires no authentication and no user interaction beyond visiting a page that embeds a shortcode. The scope-changed CVSS vector reflects that the injected SQL can access data outside the vulnerable component's security boundary, including WordPress user records, session tokens, and other tables in the same database.

Root Cause

The root cause is missing input validation on cookie data used in SQL query construction, mapped to CWE-89. The plugin concatenates the raw cookie value into a query string rather than using WordPress's $wpdb->prepare() with placeholder binding. Escaping via esc_sql() or sanitization with functions such as sanitize_text_field() is also absent.

Attack Vector

An attacker crafts an HTTP request with a malicious cookie header targeting any front-end page that renders a LogMyTrip shortcode. The plugin retrieves the cookie value during shortcode processing and embeds it directly into a SQL statement. Time-based, boolean-based, and UNION-based injection techniques are all viable against this pattern.

The vulnerability manifests when the shortcode handler reads the cookie and constructs the query. See the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-16572

Indicators of Compromise

Unusual cookie values in web server access logs containing SQL keywords such as UNION, SELECT, SLEEP, or BENCHMARK
Repeated requests to pages containing LogMyTrip shortcodes with varying cookie payloads
Database error entries in PHP or WordPress debug logs referencing LogMyTrip queries
Anomalous outbound data volumes from the WordPress host following requests with crafted cookies

Detection Strategies

Inspect web application firewall (WAF) logs for SQL metacharacters and time-based payloads in cookie headers
Correlate HTTP requests carrying suspicious cookies with slow query log entries in MySQL or MariaDB
Alert on any 500 responses returned from URLs known to render LogMyTrip shortcodes

Monitoring Recommendations

Enable WordPress query logging temporarily to review parameters entering $wpdb calls originating from the plugin
Monitor the wp_users and wp_options tables for unauthorized read patterns and unexpected access
Baseline normal cookie length and character sets, then flag deviations that include quote characters or SQL syntax

How to Mitigate CVE-2026-16572

Immediate Actions Required

Deactivate the LogMyTrip plugin on all affected WordPress sites until a patched version is released
Remove or replace shortcodes referencing LogMyTrip from public pages and posts
Deploy a WAF rule that blocks SQL syntax in cookies sent to WordPress front-end URLs
Rotate WordPress administrator credentials and secret keys defined in wp-config.php if exploitation is suspected

Patch Information

At the time of publication, no fixed version beyond 1.9 has been identified in the referenced advisory. Site owners should monitor the WPScan Vulnerability Report and the WordPress plugin repository for a patched release. Until a fix is available, treat all deployments of LogMyTrip through version 1.9 as vulnerable.

Workarounds

Remove the plugin entirely from the wp-content/plugins/ directory if it is not business-critical
Restrict access to pages containing LogMyTrip shortcodes to authenticated users through a membership or access-control plugin
Configure the WAF or reverse proxy to strip or reject the specific cookie name consumed by the plugin
Enforce least-privilege on the MySQL account used by WordPress to limit the impact of successful injection

bash

# Example ModSecurity rule to block SQL syntax in cookies
SecRule REQUEST_COOKIES "@rx (?i)(union[\s\+]+select|sleep\(|benchmark\(|--|/\*)" \
    "id:1016572,phase:1,deny,status:403,msg:'CVE-2026-16572 LogMyTrip cookie SQLi'"