External risk intelligence

Shinetheme Traveler Blind SQL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-93947

The vulnerability affects a WordPress theme, which is a type of web application component. WordPress sites are frequently deployed as public-facing websites, making the underlying theme code reachable and accessible from the internet by design.

SQL Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical SQL injection vulnerability has been identified in the Shinetheme Traveler WordPress theme. This flaw could allow unauthorized access to or manipulation of sensitive data if exploited. The main concern is confirming the relevance and exposure of this vulnerability to our systems.

Flaw allows unauthorized data access.
Affects a widely used website component.
Confirm if our websites are impacted.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted requests over the network to a website using the affected Traveler theme. Because no authentication is required, an unauthenticated attacker could trigger the flaw. This could lead to a blind SQL injection, allowing the attacker to infer information from the site's database.

Vulnerable component exposed to the internet.
Specially crafted network requests.
Blind SQL injection.

Live Threat

Current exploitation, exposure, and threat context

A SQL injection vulnerability in the Traveler theme could allow an unauthenticated attacker to extract sensitive data from the website's database when a specially crafted request is made. This could potentially expose system data or user information stored within the database.

Database contents could be exposed.
Attacker sends malicious SQL queries.
Sensitive data disclosure or system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SQL injection vulnerability in the Shinetheme Traveler theme requires immediate attention from the application or website owner responsible for managing WordPress themes. The first step is to identify all instances of the Traveler theme across your digital footprint, confirm its accessibility from the internet, and assess its business criticality to prioritize remediation efforts. Coordinate with the vendor or relevant development team to plan and implement a fix, potentially involving temporary risk reduction measures if immediate patching is not feasible.

Application owners should address this issue.
Verify Traveler theme exposure and criticality first.
Plan remediation and coordinate with the vendor.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Shinetheme Traveler product?

Traveler is a WordPress theme designed for travel and booking websites. It provides the visual layout, booking engine capabilities, and user interface elements that allow site visitors to search for and reserve travel services directly through a WordPress-powered site.

What does SQL injection mean for CVE-2026-93947?

This vulnerability is classified as Improper Neutralization of Special Elements used in an SQL Command, or SQL Injection (CWE-89). It means the theme fails to properly filter user input before using it in database queries. Because it is a 'blind' injection, an attacker cannot see the direct query results but can infer information by observing how the website responds to specifically crafted data requests.

How can an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network requests to a site running the affected Traveler theme. The process does not require the attacker to have an account or any special permissions on the website. Simply visiting the site with malicious input hidden in the request is sufficient; the vulnerability is not triggered by standard, legitimate user interactions.

Why is this CVE considered relevant to internet-facing sites?

According to Halo Surface Signal, this vulnerability is highly relevant because it affects a WordPress theme, which is a component of a web application. Since WordPress sites are typically designed to be public-facing and accessible over the internet, the code in the Traveler theme is reachable by anyone online, increasing the potential for remote exploitation.

Do I need to check my sites for the Traveler theme?

Yes. If you manage WordPress sites, you should first identify every instance where the Traveler theme is active. Once identified, evaluate if the site is reachable from the internet. Prioritize these sites for updates and coordinate with your development team or the theme vendor to obtain and apply the necessary fix to secure your database.

References

patchstack.com/database/wordpress/theme/traveler/vulnerability/wordp…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.