The vulnerability is an SQL Injection flaw caused by improper neutralization of special elements in SQL commands. Attackers can supply crafted input that is executed directly by the database, allowing them to read, modify, or delete any data stored by the affected WordPress site. The weakness is classified as CWE-89, which directly impacts confidentiality, integrity, and potentially availability if the attacker can disrupt database operations.

The issue affects the Traveler Code plugin by shinetheme on WordPress installations. All plugin versions prior to 3.1.3 are vulnerable, regardless of the WordPress core version.

The CVSS score of 8.5 marks this flaw as a high‑severity vulnerability. The EPSS score is below 1%, suggesting that, while exploitation is possible, it currently seems unlikely in the wild. The flaw is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector requires a user who can submit data through the plugin’s subscriber+ functionality, so an authenticated or user‑role‑based attack is inferred. Achieving the injection could allow an attacker to retrieve or manipulate sensitive information, leading to a significant impact on the site.