What is the CVSS score of CVE-2026-49776?

CVE-2026-49776 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.3%.

Which versions of GPTranslate WordPress Plugin are affected by CVE-2026-49776?

GPTranslate WordPress plugin versions 2.32.6 and earlier contain an unauthenticated SQL injection vulnerability (CVSS 9.3) that allows remote attackers to extract database contents without…

How to fix or mitigate CVE-2026-49776?

Within 24 hours: Inventory all WordPress instances running GPTranslate and document installed versions. Within 7 days: Disable or remove the plugin from production environments; deploy WAF rules blocking SQL injection payloads; monitor jExtensions Store advisory for patch announcement. Within 30 days: Apply vendor patch immediately upon release, or migrate to alternative WordPress translation plugin if GPTranslate patch remains unavailable.

GPTranslate WordPress Plugin CVE-2026-49776

EUVD-2026-36896 CRITICAL

SQL Injection (CWE-89)

2026-06-15 Patchstack

GHSA-2f68-qpff-692q

WordPress SQLi Wordpress Plugin Gptranslate Multilingual Ai Translation For Wordpress

9.3

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

9.9 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N); scope change since SQLi reaches the WordPress DB beyond plugin authority; raised I to L since SQLi can typically modify rows.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:28 vuln.today

CVE Published

Jun 15, 2026 - 20:19 cve.org

CRITICAL 9.3

DescriptionCVE.org

Unauthenticated SQL Injection in GPTranslate - Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

Articles & Coverage 1

News Critical SQL Injection in WordPress GPTranslate Plugin - CVE-2026-49776 Jun 16, 2026

AnalysisAI

Unauthenticated SQL injection in the GPTranslate - Multilingual AI Translation for WordPress plugin (versions 2.32.6 and earlier) by jExtensions Store allows remote attackers to inject arbitrary SQL into backend database queries without credentials or user interaction. The CVSS 9.3 score reflects a scope change with high confidentiality impact and low availability impact, indicating data exposure beyond the plugin's own context. No public exploit identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a high-priority patch.

Technical ContextAI

GPTranslate is a WordPress plugin developed by jExtensions Store that provides AI-driven multilingual translation for WordPress sites, automatically translating site content into multiple languages. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), meaning user-controllable input is concatenated into SQL queries without proper sanitization or parameterization - typically via $wpdb->query() or direct database calls that bypass WordPress's prepared statement APIs. The affected CPE (cpe:2.3:a:jextensions_store:gptranslate...) confirms the vendor is jExtensions Store, and because the plugin operates within the WordPress runtime, a successful injection executes against the WordPress database containing wp_users, wp_options, and other sensitive tables.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/gptranslate/vulnerability/wordpress-gptranslate-multilingual-ai-translation-for-wordpress-automatically-translate-websites-plugin-2-32-6-sql-injection-vulnerability) and the WordPress plugin repository for the exact fix release above 2.32.6 and upgrade immediately. If patching cannot be performed promptly, deactivate and remove the GPTranslate plugin entirely - the trade-off is losing automated multilingual translation functionality, which may break translated frontend pages. As a temporary compensating control, deploy a WAF rule (Wordfence, Patchstack mitigation, or Cloudflare managed rules) to block SQLi patterns targeting the plugin's REST/AJAX endpoints, accepting that custom payloads may bypass generic signatures; additionally restrict access to wp-admin/admin-ajax.php and the plugin's frontend endpoints by IP allowlist where feasible.