{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/transliterator-serbian-transliteration/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-39732"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Transliterator (serbian-transliteration)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Transliterator WordPress plugin is vulnerable to unauthenticated SQL injection (CVE-2026-39732) due to insufficient input filtering on the 'name' query variable. Attackers can bypass input constraints by using double percent-encoded single quotes ('%2527'), which allows for boolean-based and time-based blind SQL injection. The vulnerability is present by default as the 'permalink-transliteration' feature is enabled in default installations. A publicly available proof-of-concept exploit is circulating.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site with the Transliterator plugin enabled.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious GET request containing a double percent-encoded payload in the 'name' query parameter.\u003c/li\u003e\n\u003cli\u003eThe plugin fails to sanitize the input, allowing the payload to break out of the SQL string literal.\u003c/li\u003e\n\u003cli\u003eAttacker performs boolean-based blind SQL injection to infer database contents based on HTTP 200 (TRUE) or HTTP 404 (FALSE) responses.\u003c/li\u003e\n\u003cli\u003eAttacker performs time-based blind SQL injection to confirm data extraction.\u003c/li\u003e\n\u003cli\u003eAttacker iteratively exfiltrates database content, such as 'wp_options' table data including sensitive configuration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately disable the Transliterator plugin on all WordPress sites until a patch is verified and applied.\u003c/li\u003e\n\u003cli\u003eReview web server access logs for requests containing the '%2527' string pattern or repeated requests to the same URL structure with varying boolean-based SQL query parameters.\u003c/li\u003e\n\u003cli\u003eAudit WordPress database logs or access logs for high-frequency automated requests originating from unknown IPs targeting the 'name' query variable.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T14:08:26Z","date_published":"2026-11-07T14:08:26Z","id":"https://feed.craftedsignal.io/briefs/2026-11-transliterator-sqli/","summary":"An unauthenticated SQL injection vulnerability in the Transliterator WordPress plugin allows attackers to extract arbitrary database content via the name query parameter using double percent-encoded payloads.","title":"Transliterator WordPress plugin: Unauthenticated SQL injection (CVE-2026-39732)","url":"https://feed.craftedsignal.io/briefs/2026-11-transliterator-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Transliterator (Serbian-Transliteration)","version":"https://jsonfeed.org/version/1.1"}