Live › vulnerability › CVE-2026-39732
The Transliterator plugin for WordPress, versions 2.5.13 and earlier, passes unvalidated input into SQL queries. An unauthenticated attacker can alter those queries to read or change data in the site's database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Transliterator WordPress plugin at version 2.5.13 or earlier are exposed, and the flaw needs no login. Sites that do not have the plugin installed can skip it. The sources do not describe any special configuration that must be enabled.
No product ranges from the sources yet.
wp-content/plugins/transliterator.2.5.13; anything at or below it is in the affected range.2.5.13; the sources do not name the exact fixed release.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-39732")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.