---
id: "CVE-2026-39732"
kind: "vulnerability"
aliases: ["CVE-2026-39732"]
title: "Transliterator WordPress plugin: unauthenticated SQL injection exposes database"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "transliterator", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-30T19:18:24+00:00"
first_seen_at: "2026-10-30T19:25:29+00:00"
updated_at: "2026-10-30T19:25:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39732", "first_seen_at": "2026-10-30T19:25:29+00:00"}]
---

# Transliterator WordPress plugin: unauthenticated SQL injection exposes database

The Transliterator plugin for WordPress, versions 2.5.13 and earlier, passes unvalidated input into SQL queries. An unauthenticated attacker can alter those queries to read or change data in the site's database.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Transliterator plugin version in the WordPress admin under Plugins, or in `wp-content/plugins/transliterator`.
- Compare the version against `2.5.13`; anything at or below it is in the affected range.

## Fix

- Move the Transliterator plugin to a version later than `2.5.13`; the sources do not name the exact fixed release.

## Timeline

- 2026-10-30T19:25:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-39732

## From the sources

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_