The LogMyTrip WordPress plugin, when at or below version 1.9, fails to sanitize a value obtained from the 'tid' cookie before embedding it in a SQL query. This oversight allows an unauthenticated user to inject arbitrary SQL statements into any page that renders one of the plugin’s shortcodes, potentially enabling data extraction, modification, or deletion.

Any WordPress site that has installed LogMyTrip version 1.9 or earlier is exposed. The vulnerability specifically targets the plugin’s handling of the 'tid' cookie on pages that display the plugin's shortcodes. No additional software components or versions were identified beyond the plugin itself.

Because the flaw is exploitable without authentication, the potential impact is wide‑area database compromise, which could support data breach or case escalation. The CVSS score is 8.6, indicating high severity. The EPSS score is <1%, suggesting a low but non‑zero exploitation probability, and the vulnerability is not yet catalogued in CISA’s KEV list. An attacker can exploit the flaw by setting a crafted 'tid' cookie and causing the plugin to execute the injected SQL against the database.