The vulnerability CVE-2026-54808 in WP Travel Gutenberg Blocks (<=3.9.4) is an improper neutralization of special elements used in SQL commands, classified as CWE-89. This results in a blind SQL injection vulnerability that can be exploited remotely without authentication or user interaction. The CVSS 3.1 base score is 9.3, reflecting critical severity with network attack vector, low attack complexity, no privileges required, and a confidentiality impact rated as high. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information from the database (high confidentiality impact). The attack does not affect integrity but has a low impact on availability. Because it is a blind SQL injection, attackers can extract data without direct feedback, making exploitation stealthy and potentially severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the affected WP Travel Gutenberg Blocks plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.