Transliterator WordPress plugin: Unauthenticated SQL injection

Summary

The WordPress plugin Transliterator up to and including version 2.5.13 contains an unauthenticated SQL injection flaw (CWE-89). A remote attacker without an account can send crafted requests to the site and influence database queries. According to the Patchstack advisory, this can allow reading, modifying or deleting database content, including user accounts and private data. The CNA scores it 9.3 (Critical), while VulDB scores it 7.3; NVD analysis is still pending.

Affected

• Transliterator WordPress plugin, versions up to and including 2.5.13

Fixed in

• Version 2.5.14 is listed as the patched version by Patchstack and the CVE record, but it is not independently verified in the research notes.
• Confirm the fix on the plugin changelog before relying on it.

Workaround

• Deactivate the plugin if no fixed version can be confirmed; test first, as transliterated permalinks may change.
• Use a web application firewall with SQL injection rules as an interim control.
• Restrict the WordPress database user to least privilege.

Exploitation

• No confirmed exploitation in the wild, according to OffSeq.
• VulDB states that no public exploit is available.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.
• Patchstack describes the vulnerability as high priority and expects exploitation; absence of evidence in the search is not proof of absence.

Our recommendation

• Check whether the Transliterator plugin is installed on any public WordPress site and which version is active.
• Update to version 2.5.14 or later once confirmed on the plugin changelog; if no fix can be confirmed, deactivate the plugin.
• Remove the plugin if it is not needed.
• Monitor the site and database for unusual requests and review user accounts for unexpected changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory patchstack.com
• VulDB entry 429315 vuldb.com
• OffSeq Radar threat entry radar.offseq.com
• WordPress.org plugin listing wordpress.org
• Strix AI CVE page www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:23.