Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

Ivijan-Stefan Stipic Transliterator

Do this now

Check the advisory for a fix and restrict access to Transliterator meanwhile.

First seen: 7 Nov 2026
Last update: 7 Nov 2026, 13:18 UTC
Versions per the CVE record from Patchstack, not the vendor: 2.5.14
Identifiers: CVE-2026-39732
CVSS: 9.3
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
Severity: critical. Patch status: fix status unknown.
Affected: Ivijan-Stefan Stipic Transliterator
Versions per the CVE record from Patchstack, not the vendor: 2.5.14
Ids: CVE-2026-39732

Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.

## Steps
1. Search the repo, its CI and infra config for Ivijan-Stefan Stipic Transliterator. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from Patchstack, not the vendor: Transliterator: <= 2.5.13 → 2.5.14. Don't treat them as a fix until the vendor says so.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Transliterator <= 2.5.13 | per the CVE record from Patchstack, not the vendor | 2.5.14 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-39732") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://nvd.nist.gov/vuln/detail/CVE-2026-39732 https://patchstack.com/database/wordpress/plugin/serbian-transliteration/vulnerability/wordpress-transliterator-plugin-2-5-13-sql-injection-vulnerability?_s_id=cve
https://pwned.coffee/i/unauthenticated-sql-injection-in-transliterator-2-5-13-v-cve-2026-39732

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from Patchstack, not the vendor: Product Affected Version named Source
Transliterator <= 2.5.13 2.5.14 CVE record (CNA) per the CVE record from Patchstack, not the vendor checked 7 Nov
Score: CVSS 9.3 (critical). CVSS 3.1 9.3 (CNA Patchstack) for CVE-2026-39732
Last checked: 7 Nov 2026, 18:18 UTC

Product	Affected	Version named	Source
Transliterator	<= 2.5.13	2.5.14	CVE record (CNA) per the CVE record from Patchstack, not the vendor checked 7 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Follow on X

Totalone very hot coffee