Transliterator WordPress plugin: Unauthenticated SQL injection (CVE-2026-39732)

The Transliterator WordPress plugin is vulnerable to unauthenticated SQL injection (CVE-2026-39732) due to insufficient input filtering on the 'name' query variable. Attackers can bypass input constraints by using double percent-encoded single quotes ('%2527'), which allows for boolean-based and time-based blind SQL injection. The vulnerability is present by default as the 'permalink-transliteration' feature is enabled in default installations. A publicly available proof-of-concept exploit is circulating.

Attack Chain

1. Attacker identifies a WordPress site with the Transliterator plugin enabled.
2. Attacker crafts a malicious GET request containing a double percent-encoded payload in the 'name' query parameter.
3. The plugin fails to sanitize the input, allowing the payload to break out of the SQL string literal.
4. Attacker performs boolean-based blind SQL injection to infer database contents based on HTTP 200 (TRUE) or HTTP 404 (FALSE) responses.
5. Attacker performs time-based blind SQL injection to confirm data extraction.
6. Attacker iteratively exfiltrates database content, such as 'wp_options' table data including sensitive configuration.

Recommendation

• Immediately disable the Transliterator plugin on all WordPress sites until a patch is verified and applied.
• Review web server access logs for requests containing the '%2527' string pattern or repeated requests to the same URL structure with varying boolean-based SQL query parameters.
• Audit WordPress database logs or access logs for high-frequency automated requests originating from unknown IPs targeting the 'name' query variable.