Transliterator CVE-2026-39732

The target must be a WordPress site running the Transliterator (Serbian Transliteration) plugin at version 2.5.13 or earlier. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required - exploitation is remote and unauthenticated against the affected plugin. The principal limiting factor is therefore product presence and version: the flaw only affects installations that have this specific plugin installed and active at a vulnerable version. The exact vulnerable parameter, endpoint, or whether any non-default plugin feature must be enabled is not described in the available sources.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the worst-case attacker profile: remotely reachable, low attack complexity, no privileges and no user interaction - i.e. unauthenticated, one-shot exploitation over the network, which for a CWE-89 SQL injection makes mass scanning and opportunistic abuse trivial. The vuln.today decision label is 'act_now', reinforcing priority. However, the raw severity signals are incomplete: no EPSS exploitation-probability score is present, the vulnerability is NOT listed in CISA KEV, and no proof-of-concept or exploit reference is supplied - only a Patchstack advisory. So there is no confirmation of active exploitation or of working public exploit code at this time; the urgency rests on the ease of exploitation and the 'act_now' label rather than on observed in-the-wild activity. One internal inconsistency is worth verifying: the supplied vector sets S:C (scope change) and C:H/I:N/A:L, which is an unusual impact distribution for SQL injection (integrity of the database is typically affected on a write-capable injection) - the exact injectable parameter and whether the flaw is read-only are not described in the available sources, so the S:C/I:N combination should be verified against the vendor advisory. Net: treat as a genuine high priority because of unauthenticated remote SQLi against a WordPress plugin, while recognizing that exploitation-likelihood telemetry (EPSS/KEV/PoC) is absent rather than negative.

A remote, unauthenticated attacker sends a crafted request to the WordPress site running the vulnerable Transliterator (Serbian Transliteration) plugin version 2.5.13 or earlier, injecting SQL through an affected parameter. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low (AC:L), the attacker can read sensitive database contents such as user records and WordPress secrets. No public exploit identified at time of analysis; the specific vulnerable endpoint is not described in the available sources.