CVE-2026-39732

Summary

The Transliterator plugin for WordPress versions up to and including 2.5.13 contains an unauthenticated SQL injection vulnerability due to improper input sanitization in a database query.

Exploitability

Exploitation is straightforward for remote attackers since no authentication or user interaction is required.

Blast radius

Successful exploitation could allow attackers to extract sensitive data from the WordPress database, potentially affecting confidentiality and availability of the underlying system.

Detection

Defenders should monitor web server access logs for requests containing suspicious SQL syntax (e.g., UNION SELECT, OR 1=1) in query parameters targeting the Translimiter plugin endpoints.

Prioritized remediation

Upgrade to Transliterator version 2.5.14 or later, which contains a fix for this SQL injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.