SQL Injection Vulnerability in Ukr-To-Lat WordPress Plugin by Ukr-Company
CVE-2026-104122
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 17 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-104122?
The Ukr-To-Lat WordPress plugin, up to version 1.3.5, contains a security flaw that allows users with Contributor-level access or higher to execute SQL injection attacks. This vulnerability arises from the plugin's failure to properly sanitize and escape user-inputted term names when constructing SQL queries, potentially exposing sensitive data or allowing unauthorized database alterations.
Affected Version(s)
Ukr-To-Lat 0 <= 1.3.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.