CVE-2026-54808: WordPress WP Travel Gutenberg Blocks plugin <= 3.9.4 - SQL Injection vulnerability

Synopsis

A SQL injection vulnerability in the WP Travel Gutenberg Blocks WordPress plugin (versions up to and including 3.9.4) allows an unauthenticated remote attacker to send crafted HTTP requests to the affected site. The exploit uses blind SQL injection, meaning the attacker infers database contents through indirect responses rather than direct output. Successful exploitation gives the attacker read access to the WordPress database and can cause partial disruption to the service. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or session token is required; the malicious requests can be sent by any anonymous user.

• Victim interactionNot required

  No user action or social engineering is needed; the attacker interacts directly with the vulnerable endpoint.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required.

Blast Radius

• Reads arbitrary rows from the WordPress database, including user credentials (hashed passwords), email addresses, session tokens, and plugin configuration data.
• Blind injection timing or boolean techniques allow the attacker to reconstruct full table contents even without direct query output.
• Causes partial availability disruption to the WordPress site as a side effect of heavy or malformed query injection.