CVE-2026-104122: Ukr-To-Lat WordPress Plugin SQLi Vulnerability

CVE-2026-104122 Overview

The Ukr-To-Lat WordPress plugin through version 1.3.5 contains a SQL injection vulnerability [CWE-89]. The plugin fails to sanitize and escape a term name before using it in a SQL query. Authenticated users with Contributor-level access or above can inject arbitrary SQL statements through this input vector. The flaw affects all releases up to and including 1.3.5.

Critical Impact
Authenticated contributors can extract sensitive database contents, including user credentials and session data, by crafting malicious term names processed by the plugin.

Affected Products

Ukr-To-Lat WordPress plugin versions through 1.3.5

Discovery Timeline

2026-10-17 - CVE-2026-104122 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-104122

Vulnerability Analysis

The Ukr-To-Lat plugin transliterates Ukrainian Cyrillic text into Latin characters for use in WordPress slugs and taxonomy terms. The plugin receives a term name and passes it into a SQL query without applying wpdb::prepare() or escaping functions such as esc_sql(). An attacker who holds Contributor privileges can submit a crafted term name that breaks out of the intended query context. The injected SQL executes with the privileges of the WordPress database user.

Successful exploitation enables extraction of data from any table in the WordPress database, including the wp_users table. The vulnerability requires authenticated access, which limits exploitation to users with existing accounts. Multi-author WordPress sites that accept contributor registrations are the primary exposure.

Root Cause

The root cause is missing input sanitization on a term name parameter before concatenation into a SQL statement. The plugin does not use parameterized queries through the $wpdb abstraction layer. This pattern maps directly to CWE-89, Improper Neutralization of Special Elements used in an SQL Command.

Attack Vector

Exploitation requires authenticated access at the Contributor role or higher. The attacker submits a term name containing SQL metacharacters through a plugin workflow that invokes the vulnerable code path. The scope-changed impact indicates data from beyond the plugin's own context can be reached. See the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-104122

Indicators of Compromise

Unexpected term entries containing SQL syntax such as UNION SELECT, --, /*, or quote characters in taxonomy tables
Database query logs showing malformed queries originating from plugin code paths
Contributor accounts generating anomalous POST requests to term management endpoints

Detection Strategies

Enable WordPress query logging and inspect term-related queries for unescaped special characters
Review web server access logs for POST requests to taxonomy or term endpoints submitted by Contributor-level accounts
Deploy a web application firewall rule set that identifies SQL injection payloads in WordPress admin requests

Monitoring Recommendations

Alert on new Contributor account registrations followed by taxonomy modification activity
Monitor the wp_terms and wp_term_taxonomy tables for entries containing SQL control characters
Track database error log entries referencing plugin-generated queries

How to Mitigate CVE-2026-104122

Immediate Actions Required

Audit the user list and remove or downgrade untrusted Contributor-level accounts
Disable the Ukr-To-Lat plugin until a patched version is available
Review taxonomy tables for signs of prior injection attempts

Patch Information

No patched version is identified in the enriched data at time of publication. The vulnerability affects the plugin through version 1.3.5. Monitor the WPScan Vulnerability Report for updates on a fixed release.

Workarounds

Restrict Contributor role assignment to trusted users only
Disable new user registration or require administrator approval before role elevation
Deploy a web application firewall with SQL injection rules in front of the WordPress site
Remove the plugin and use an alternative transliteration solution if a patch is not available

bash

# Disable the plugin via WP-CLI
wp plugin deactivate ukr-to-lat
wp plugin delete ukr-to-lat

# Audit Contributor-level and above accounts
wp user list --role=contributor --fields=ID,user_login,user_email,user_registered