CVE-2026-16572: Unknown Logmytrip

High severity, CVSS 8.6. EPSS: 0.4% chance of exploitation in the next 30 days.

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

Affected products

• Unknown Logmytrip: up to and including 1.9

Published 2026-08-03. Last modified 2026-08-26.