LogMyTrip Plugin SQL Injection via Unsanitized Cookie Values

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin through 1.9's shortcodes.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-16572 exposes a critical SQL injection vulnerability in the LogMyTrip WordPress plugin (versions through 1.9) where unsanitized cookie values are directly embedded into SQL queries. This vulnerability is particularly dangerous because it requires no authentication—any unauthenticated attacker can exploit it simply by visiting a page containing one of the plugin's shortcodes. With a CVSS score of 8.6, this represents a high-severity risk affecting any WordPress installation using this plugin. The vulnerability stems from improper input validation (CWE-89) and could allow attackers to extract sensitive database information, modify or delete data, or potentially escalate privileges.

Casky's 322 matching skills leverage Claude's extended reasoning capabilities to identify attack patterns associated with the MITRE techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance) by detecting SQL query anomalies and suspicious cookie manipulation. Practitioners using Casky would observe findings flagging abnormal SQL syntax in server logs, unexpected database queries originating from shortcode processing, and cookie values containing SQL metacharacters or common injection payloads like UNION-based or time-based blind SQL injection patterns. The platform's skill mapping allows security teams to correlate these technical indicators with MITRE ATT&CK reconnaissance activities, identifying when threat actors are probing for database structure or attempting to extract sensitive information through malformed requests—enabling rapid detection and response before exploitation occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-16572.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-16572

Casky has 322 skills that investigate the attack patterns behind CVE-2026-16572. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn