Key points
- The vulnerability, CVE-2026-93947, is rated critical with a CVSS score of 9.3.
- It allows attackers to perform blind SQL injection attacks on affected installations.
- All versions of the Shinetheme Traveler plugin up to and including 3.2.9 are affected.
Security teams are being alerted to a critical vulnerability within the Shinetheme Traveler WordPress plugin that could allow attackers to extract sensitive data from database backends. The flaw, identified as CVE-2026-93947, enables blind SQL injection, a technique where an attacker sends specific queries to the application and deduces information based on the application’s response or behaviour, rather than seeing the data directly.
The National Vulnerability Database (NVD) has assigned this issue a CVSS score of 9.3, classifying it as critical. The weakness stems from improper neutralisation of special elements used in SQL commands. This means that user-supplied input is not sufficiently sanitised before being incorporated into database queries, allowing malicious actors to manipulate the underlying SQL logic.
Context and technical background
SQL injection remains one of the most prevalent and dangerous web application vulnerabilities. In the case of CVE-2026-93947, the specific variant is blind SQL injection. Unlike traditional SQL injection, where error messages might reveal database structure or content, blind injection requires the attacker to infer data by observing how the application behaves—such as whether a page loads successfully or returns an error.
According to the NVD record, the weakness is categorised under CWE-89, which refers to the improper neutralisation of special elements in SQL commands. This type of flaw can lead to unauthorised access to sensitive information, including user credentials, personal data, and other confidential records stored within the WordPress database. The high severity rating reflects the potential for significant data compromise and the relative ease with which automated tools can exploit such flaws.
Who is affected
The vulnerability affects all installations of the Shinetheme Traveler WordPress plugin running versions from its initial release up to 3.2.9. Any website utilising this specific plugin within that version range is potentially exposed to exploitation. Security operations teams should immediately audit their WordPress environments to determine if this plugin is present and, if so, check the installed version against the affected range.
Our take on the response
Given the critical rating and the nature of SQL injection vulnerabilities, immediate action is required for any organisation using the affected software. While the source material does not confirm the availability of a patched version, the presence of a defined affected version range (up to 3.2.9) typically implies that a fix may be forthcoming or that users should monitor vendor communications closely. Until a confirmed fix is available, the risk remains high for exposed systems.
What to do and how to stay safe: Shinetheme Traveler
- Conduct an immediate inventory of all WordPress plugins to identify if Shinetheme Traveler is installed and check its version number.
- Monitor web server logs and database audit trails for unusual query patterns or unexpected responses that may indicate blind SQL injection attempts.
- Implement a Web Application Firewall (WAF) with rules specifically tuned to detect and block SQL injection payloads targeting this plugin.
- Once the vendor provides an update, apply it promptly after testing for compatibility in a staging environment.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for the Shinetheme Traveler vulnerability?
The CVSS score is 9.3, which is rated as critical.
Which versions of the Shinetheme Traveler plugin are affected?
All versions from the initial release up to and including 3.2.9 are affected.
What type of vulnerability is CVE-2026-93947?
It is a blind SQL injection vulnerability caused by improper neutralisation of special elements in SQL commands.