An improper handling of special characters in SQL statements allows an attacker to inject arbitrary SQL commands regardless of authentication. This SQL injection flaw (CWE‑89) could enable the attacker to read, modify, or delete data within the WordPress site’s database, potentially exposing sensitive information or disrupting service.

The vulnerability affects WordPress Traveler Code plugin by Shinetheme, specifically versions 3.1.0 and earlier up to but not including 3.1.2. Sites running those versions are at risk if the plugin is active.

The CVSS score of 9 indicates severe impact, yet the EPSS score of less than 1% suggests exploitation is unlikely at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the flaw by sending crafted requests to the plugin’s endpoints without needing credentials, making the risk immediate for unauthenticated users.