Live › vulnerability › CVE-2026-104122
Go to dashboardThe Ukr-To-Lat WordPress plugin up to version 1.3.5 puts a term name into a SQL query without sanitizing or escaping it. A logged-in user with Contributor access or higher can inject SQL and read or alter database content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Ukr-To-Lat plugin at version 1.3.5 or earlier are exposed. The attack needs an account with Contributor role or higher, so sites with open registration or many authors carry the most risk; sites without this plugin can skip it.
No product ranges from the sources yet.
wp plugin get ukr-to-lat --field=version (plugin slug assumed from the name; confirm with wp plugin list).1.3.5; the fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-104122")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.