This vulnerability is an SQL injection flaw in the Traveler theme that allows an attacker to submit specially crafted input that is incorporated into an SQL command without proper sanitization. The flaw can lead to blind SQL injection, giving an attacker read or modify access to the site’s database. The weakness matches CWE‑89, and if exploited it could compromise confidentiality, integrity, or availability of the data stored by the WordPress site.

All versions of Shinetheme Traveler from the first released version through any version prior to 3.2.8 are affected. The entry points are likely form fields or URL parameters handled by the theme where user-supplied data is passed directly into database queries.

The CVSS v3.1 score of 8.8 indicates high severity. The EPSS of less than 1% suggests low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would likely need to locate a vulnerable instance, craft an input that triggers the injection, and wait for a blind response, which can be inferred from lack of error messages or timing differences. Given the high severity and potential impact, the risk escalates if the compromised data contains sensitive user information.