CVE-2026-16572 is a SQL injection vulnerability in the LogMyTrip WordPress plugin through version 1.9. The plugin fails to sanitize and escape a value taken from a cookie before using it in a SQL query. This allows unauthenticated users to perform SQL injection attacks on any page that renders one of the plugin's shortcodes, potentially exposing sensitive data. The CVSS 3.1 base score is 8.6, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact classified as high. There is no official remediation or patch information available at this time.

An unauthenticated attacker can exploit this vulnerability to perform SQL injection attacks, potentially leading to unauthorized disclosure of sensitive information from the database. The vulnerability affects confidentiality but does not impact integrity or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the LogMyTrip plugin or removing shortcodes that render its content to prevent exploitation.