An input sanitization flaw in shinetheme Traveler permits blind SQL injection. A remote attacker could send crafted queries through the theme’s form fields or URL parameters, allowing them to read, modify, or delete data stored in the WordPress database. Depending on the attacker's privileges, this could lead to full data exfiltration, credential theft, or compromise of the entire site’s content.

All installations of the Traveler WordPress theme released before version 3.2.6 are affected. The vulnerability applies to every deployment of Traveler under the shinetheme vendor that has not upgraded to the patched release.

The CVSS score of 8.5 indicates a high severity vulnerability with a high likelihood of exploitable impact. The EPSS score of less than 1% suggests that the immediate exploitation probability remains low, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would most likely exploit the flaw via standard web requests targeting the theme’s input interfaces, inferring the attack vector from the presence of uncontrolled database operations in the code.