Unauthenticated SQL Injection in Serbian Transliteration Plugin by WordPress
CVE-2026-39732

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Transliterator
Vendor
CVE Published:
30 October 2026

What is CVE-2026-39732?

The Serbian Transliteration Plugin for WordPress suffers from an unauthenticated SQL injection vulnerability in version 2.5.13. This flaw allows attackers to manipulate SQL queries by injecting malicious input into the application. Unauthenticated users could exploit this vulnerability to gain unauthorized access and potentially compromise sensitive data within the database. Website owners should promptly update to secure their applications against such threats.

Affected Version(s)

Transliterator <= 2.5.13

References

https://patchstack.com/database/wordpress/plugin/serbian-...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mor Golan | Patchstack Bug Bounty Program
.