{"id":"CVE-2026-39732","published":"2026-10-30T19:18:24.137","lastModified":"2026-10-30T19:22:27.173","description":"Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/serbian-transliteration/vulnerability/wordpress-transliterator-plugin-2-5-13-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Transliterator plugin for WordPress versions up to and including 2.5.13 contains an unauthenticated SQL injection vulnerability due to improper input sanitization in a database query.","exploitability":"Exploitation is straightforward for remote attackers since no authentication or user interaction is required.","blast_radius":"Successful exploitation could allow attackers to extract sensitive data from the WordPress database, potentially affecting confidentiality and availability of the underlying system.","remediation":"Upgrade to Transliterator version 2.5.14 or later, which contains a fix for this SQL injection vulnerability.","detection":"Defenders should monitor web server access logs for requests containing suspicious SQL syntax (e.g., UNION SELECT, OR 1=1) in query parameters targeting the Translimiter plugin endpoints.","tags":["sql-injection","unauthenticated","wordpress-plugin","cwe-89"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:49:15.097Z"}}