CVE-2026-39732: SQL Injection in Transliterator Plugin

CVE-2026-39732 is an unauthenticated SQL injection vulnerability reported in the WordPress plugin Transliterator affecting all versions up to 2.5.13. An unauthenticated attacker can exploit this flaw to send direct SQL queries to the database, compromising data integrity and confidentiality. Every WordPress site running this plugin faces immediate risk of unauthorized external access.

The vulnerability carries a CVSS score of 9.3, classified as critical severity. The CVE was published on October 30, 2026, by the National Vulnerability Database. As of November 7, 2026, a proof-of-concept demonstration of the exploit is publicly available on GitHub repositories, significantly increasing the risk of widespread attacks. Active exploitation in the wild has not been confirmed at this time.

Site administrators must immediately update the Transliterator plugin to a version beyond 2.5.13 as soon as a patched version is released by the vendor. In the interim, disabling the plugin is recommended if not mission-critical. Review database and file access logs for suspicious SQL queries or unauthorized access patterns. Monitor vendor security advisories for definitive patching instructions.