{"id":"CVE-2026-104122","kind":"vulnerability","aliases":["CVE-2026-104122"],"related":[],"title":"Ukr-To-Lat WordPress plugin: term name lets contributors run SQL injection","description":"The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks.","summary":"The Ukr-To-Lat WordPress plugin up to version 1.3.5 puts a term name into a SQL query without sanitizing or escaping it. A logged-in user with Contributor access or higher can inject SQL and read or alter database content.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["contributor-roles-not-granted","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get ukr-to-lat --field=version` (plugin slug assumed from the name; confirm with `wp plugin list`).\n- Review which accounts hold Contributor or higher roles.","fix":"- Update the Ukr-To-Lat plugin to a version later than `1.3.5`; the fixed version is unknown from the sources.\n- If no fixed version exists, deactivate the plugin until a patch is released.","status":"open","published_at":"2026-10-17T06:16:33+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:45:08+00:00","updated_at":"2026-10-25T03:45:08+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:45:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Ukr-To-Lat plugin to a version later than `1.3.5`; the fixed version is unknown from the sources.\n- If no fixed version exists, deactivate the plugin until a patch is released.","reach":"network","title":"Ukr-To-Lat WordPress plugin: term name lets contributors run SQL injection","impact":"medium","summary":"The Ukr-To-Lat WordPress plugin up to version 1.3.5 puts a term name into a SQL query without sanitizing or escaping it. A logged-in user with Contributor access or higher can inject SQL and read or alter database content.","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads or alters the WordPress database through injected SQL","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for the fixed version and whether the plugin is still maintained.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get ukr-to-lat --field=version` (plugin slug assumed from the name; confirm with `wp plugin list`).\n- Review which accounts hold Contributor or higher roles.","needs_analyst":true,"not_affected_if":["plugin-not-installed","contributor-roles-not-granted"],"who_is_affected":"Sites running the Ukr-To-Lat plugin at version 1.3.5 or earlier are exposed. The attack needs an account with Contributor role or higher, so sites with open registration or many authors carry the most risk; sites without this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000636,"input_tokens":3301,"output_tokens":611,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104122':16A,19A '-2026':15A,18A '1.3.5':36B,77C 'access':57B,99C 'allow':93C 'alter':66B 'attack':106C 'content':68B 'contributor':10A,56B,97C 'contributor-level':96C 'cve':14A,17A 'databas':67B 'escap':48B,82C 'higher':59B 'host':24B 'inject':13A,61B,105C 'lat':4A,30B,73C 'let':9A 'level':98C 'log':52B 'logged-in':51B 'name':8A,40B,85C 'packag':20B 'perform':103C 'php':21B 'plugin':6A,32B,75C 'put':37B 'queri':44B,92C 'read':64B 'run':11A 'sanit':46B,80C 'self':23B 'self-host':22B 'sql':12A,43B,62B,91C,104C 'term':7A,39B,84C 'ukr':2A,28B,71C 'ukr-to-lat':1A,27B,70C 'use':87C 'user':54B,94C 'version':35B 'without':45B 'wordpress':5A,25B,31B,74C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Ukr-To-Lat plugin at version 1.3.5 or earlier are exposed. The attack needs an account with Contributor role or higher, so sites with open registration or many authors carry the most risk; sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T06:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104122","severity":null,"published_at":"2026-10-17T06:16:33+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}