Ukr-To-Lat CVE-2026-104122

Requires an authenticated WordPress account with Contributor role or higher on a site running the Ukr-To-Lat plugin version ≤1.3.5. Exploitation targets the term-name input, which is used unsanitized in a SQL query (CWE-89). Limiting factors: the attacker must already hold valid Contributor-level credentials (not unauthenticated), so risk is highest where open user registration is enabled or where low-tier accounts can be phished/compromised; impact is confidentiality-only (data disclosure), with no stated integrity or availability effect. Note the input CVSS lists PR:H, which contradicts the Contributor-level description and likely overstates the required privilege.

This is a moderate-priority, not a top-priority, issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N, base 6.8) describes a network-reachable, low-complexity SQL injection yielding high confidentiality impact with no integrity or availability impact. A key internal conflict exists: the CVSS vector encodes PR:H (high privileges), but the description states exploitation requires only 'Contributor-level access and above' - Contributor is a low-privileged authenticated WordPress role, which conventionally maps to PR:L. This discrepancy likely understates ease of exploitation and should be verified. No EPSS score, KEV listing, or POC indicator was supplied in the input, so exploitation probability cannot be quantified; per available signals there is no public exploit identified at time of analysis and no evidence of active exploitation. The requirement for an authenticated Contributor account materially limits real-world risk to attackers who already hold a foothold (e.g., via open registration or compromised low-tier accounts), making this an insider/post-foothold privilege-leverage flaw rather than a mass-exploitable unauthenticated bug. Combined with the plugin's niche footprint, this is a 'patch in normal cycle' item, not an emergency.

An attacker who has obtained a WordPress Contributor-level account (via open user registration or credential compromise) submits a term name containing a crafted SQL payload, which is concatenated unsanitized into a backend SQL query. The injection lets them read sensitive database contents such as other users' data and password hashes. No public exploit code was identified in the provided data, and low attack complexity means exploitation is straightforward once authenticated.