A high severity SQL injection vulnerability in the LogMyTrip WordPress plugin exposes the database to potential unauthorized data exfiltration by unauthenticated attackers.

This vulnerability is a SQL injection flaw, categorized as CWE-89, which permits unauthenticated remote attackers to manipulate database queries. The vulnerability allows for the unauthorized disclosure of information due to improper input sanitization.

The exploitation of this vulnerability could lead to the total compromise of sensitive data stored within the WordPress database. Given the CVSS score of 8.6, this represents a significant risk to data confidentiality and integrity, potentially leading to regulatory non-compliance and severe reputational damage.

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately deactivate and remove the LogMyTrip plugin from all WordPress installations until a vendor-verified secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious patterns or anomalous syntax that may indicate automated SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection payloads targeting the WordPress environment.

Public Exploit Available: No

Given the high CVSS score and the potential for unauthenticated database access, immediate removal of the vulnerable plugin is the only effective mitigation at this time. Security teams should audit their environments to identify all instances of the LogMyTrip plugin and ensure they are disabled until the vendor provides a formal security update.