CVE-2026-16572: LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

Q: What is the severity of CVE-2026-16572?

The severity of CVE-2026-16572 is rated high, with a CVSS score of 8.6.

Q: How do I fix CVE-2026-16572?

To fix CVE-2026-16572, upgrade the LogMyTrip plugin to version 1.9.1 or later, which addresses this vulnerability.

Q: What type of attack does CVE-2026-16572 facilitate?

CVE-2026-16572 facilitates unauthenticated SQL injection attacks through the 'tid' cookie.

Q: What versions of LogMyTrip are affected by CVE-2026-16572?

LogMyTrip versions up to and including 1.9 are affected by CVE-2026-16572.

Q: Can CVE-2026-16572 be exploited by authenticated users?

CVE-2026-16572 can be exploited by unauthenticated users, requiring no special privileges.

Published Aug 3, 2026

Updated

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

Affected Software

1 affected component

WordPress LogMyTrip<=1.9

Event History

Aug 3, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-16572?

The severity of CVE-2026-16572 is rated high, with a CVSS score of 8.6.

How do I fix CVE-2026-16572?

To fix CVE-2026-16572, upgrade the LogMyTrip plugin to version 1.9.1 or later, which addresses this vulnerability.

What type of attack does CVE-2026-16572 facilitate?

CVE-2026-16572 facilitates unauthenticated SQL injection attacks through the 'tid' cookie.

What versions of LogMyTrip are affected by CVE-2026-16572?

LogMyTrip versions up to and including 1.9 are affected by CVE-2026-16572.

Can CVE-2026-16572 be exploited by authenticated users?

CVE-2026-16572 can be exploited by unauthenticated users, requiring no special privileges.

CVE-2026-16572: LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-16572?

How do I fix CVE-2026-16572?

What type of attack does CVE-2026-16572 facilitate?

What versions of LogMyTrip are affected by CVE-2026-16572?

Can CVE-2026-16572 be exploited by authenticated users?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-16572?

How do I fix CVE-2026-16572?

What type of attack does CVE-2026-16572 facilitate?

What versions of LogMyTrip are affected by CVE-2026-16572?

Can CVE-2026-16572 be exploited by authenticated users?