Shinetheme Traveler: Blind SQL injection in WordPress theme
Summary
The WordPress theme Traveler up to and including version 3.2.9 is vulnerable to blind SQL injection. An unauthenticated remote attacker can send crafted requests and extract database contents, such as user accounts and customer data, indirectly without visible error messages. Because blind injection is slow and quiet, the activity can be hard to detect.
Affected
- Shinetheme Traveler WordPress theme, versions up to and including 3.2.9
Fixed in
- Version 3.3 or later, according to Patchstack and the CVE record ("at least 3.3")
- The vendor changelog did not confirm the fixed version at the time of research; verify before patching
Workaround
- No vendor workaround known.
- Patchstack has issued a mitigation rule (virtual patch) that blocks attacks until the update is applied, if you use Patchstack.
- Restrict or take down public booking and admin endpoints until the update is installed.
- Use a web application firewall with SQL injection rules as an interim measure; this is general guidance and not validated for this CVE.
Exploitation
- No evidence of exploitation in the wild found in the sources reviewed.
- No public proof-of-concept found; this is not a confirmed absence.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- EPSS 0.00236 (low predicted exploitation).
- Patchstack expects exploitation and notes that similar vulnerabilities are used in mass-exploit campaigns.
Our recommendation
- Identify all Traveler installations and their versions.
- Update to version 3.3 or later, after confirming in the vendor changelog that the update fixes this CVE.
- Apply the interim mitigations above if updating is not immediately possible.
- Back up the website and database before updating.
- Check logs for SQL error messages and unusual requests to booking endpoints.
- Review whether personal data may have been exposed and assess data protection obligations under the Swiss revFADP.
- Do not use nulled or pirated copies of the theme.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack: WordPress Traveler theme <= 3.2.9 SQL Injection patchstack.com
- Vulners: CVE-2026-93947 (RAPID7 record, EPSS) vulners.com
- VulDB: CVE-2026-93947 vuldb.com
- Strix: CVE-2026-93947 www.strix.ai
- ThemeForest: Traveler theme (Shinetheme) themeforest.net
- Traveler theme changelog (vendor) travelerwp.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:48.
Original description (NVD)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.