Transliterator (Serbian-Transliteration) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/transliterator-serbian-transliteration/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 07 Nov 2026 14:08:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgTransliterator WordPress plugin: Unauthenticated SQL injection (CVE-2026-39732)https://feed.craftedsignal.io/briefs/2026-11-transliterator-sqli/Sat, 07 Nov 2026 14:08:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-transliterator-sqli/An unauthenticated SQL injection vulnerability in the Transliterator WordPress plugin allows attackers to extract arbitrary database content via the name query parameter using double percent-encoded payloads.The Transliterator WordPress plugin is vulnerable to unauthenticated SQL injection (CVE-2026-39732) due to insufficient input filtering on the 'name' query variable. Attackers can bypass input constraints by using double percent-encoded single quotes ('%2527'), which allows for boolean-based and time-based blind SQL injection. The vulnerability is present by default as the 'permalink-transliteration' feature is enabled in default installations. A publicly available proof-of-concept exploit is circulating.

Attack Chain

  1. Attacker identifies a WordPress site with the Transliterator plugin enabled.
  2. Attacker crafts a malicious GET request containing a double percent-encoded payload in the 'name' query parameter.
  3. The plugin fails to sanitize the input, allowing the payload to break out of the SQL string literal.
  4. Attacker performs boolean-based blind SQL injection to infer database contents based on HTTP 200 (TRUE) or HTTP 404 (FALSE) responses.
  5. Attacker performs time-based blind SQL injection to confirm data extraction.
  6. Attacker iteratively exfiltrates database content, such as 'wp_options' table data including sensitive configuration.

Recommendation

  • Immediately disable the Transliterator plugin on all WordPress sites until a patch is verified and applied.
  • Review web server access logs for requests containing the '%2527' string pattern or repeated requests to the same URL structure with varying boolean-based SQL query parameters.
  • Audit WordPress database logs or access logs for high-frequency automated requests originating from unknown IPs targeting the 'name' query variable.
]]>highadvisory