{"id":"CVE-2026-39732","kind":"vulnerability","aliases":["CVE-2026-39732"],"related":[],"title":"Transliterator WordPress plugin: unauthenticated SQL injection exposes database","description":"Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.","summary":"The Transliterator plugin for WordPress, versions 2.5.13 and earlier, passes unvalidated input into SQL queries. An unauthenticated attacker can alter those queries to read or change data in the site's database.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","transliterator","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed Transliterator plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/transliterator`.\n- Compare the version against `2.5.13`; anything at or below it is in the affected range.","fix":"- Move the Transliterator plugin to a version later than `2.5.13`; the sources do not name the exact fixed release.","status":"open","published_at":"2026-10-30T19:18:24+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","triaged_at":"2026-10-30T19:25:46+00:00","updated_at":"2026-10-30T19:25:46+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-30T19:25:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Transliterator plugin to a version later than `2.5.13`; the sources do not name the exact fixed release.","reach":"internet","title":"Transliterator WordPress plugin: unauthenticated SQL injection exposes database","impact":"high","summary":"The Transliterator plugin for WordPress, versions 2.5.13 and earlier, passes unvalidated input into SQL queries. An unauthenticated attacker can alter those queries to read or change data in the site's database.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","transliterator","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reads or alters the WordPress database without logging in","analyst_note":"Confirm the first fixed Transliterator version and the vulnerable parameter at https://nvd.nist.gov/vuln/detail/CVE-2026-39732 and the plugin's changelog.","how_to_check":"- Check the installed Transliterator plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/transliterator`.\n- Compare the version against `2.5.13`; anything at or below it is in the affected range.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Transliterator WordPress plugin at version 2.5.13 or earlier are exposed, and the flaw needs no login. Sites that do not have the plugin installed can skip it. The sources do not describe any special configuration that must be enabled.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000699,"input_tokens":4049,"output_tokens":589,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':10A,13A '-39732':11A,14A '2.5.13':27B,58C 'alter':40B 'attack':38B 'chang':46B 'cve':9A,12A 'data':47B 'databas':8A,52B 'earlier':29B 'expos':7A 'host':18B 'inject':6A,55C 'input':32B 'packag':15B 'pass':30B 'plugin':3A,23B 'queri':35B,42B 'read':44B 'self':17B 'self-host':16B 'site':50B 'sql':5A,34B,54C 'transliter':1A,19B,22B,57C 'unauthent':4A,37B,53C 'unvalid':31B 'version':26B,59C 'wordpress':2A,20B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Transliterator WordPress plugin at version 2.5.13 or earlier are exposed, and the flaw needs no login. Sites that do not have the plugin installed can skip it. The sources do not describe any special configuration that must be enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-39732","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39732","severity":null,"published_at":"2026-10-30T19:18:24+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:29+00:00","fetched_at":"2026-10-30T19:25:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}