CVE-2026-49776: GPTranslate WordPress Plugin SQLi Flaw

CVE-2026-49776 Overview

CVE-2026-49776 is an unauthenticated SQL injection vulnerability in the GPTranslate – Multilingual AI Translation for WordPress plugin. The flaw affects all plugin versions up to and including 2.32.6. Remote attackers can inject arbitrary SQL statements through the plugin without supplying credentials or interacting with a user.

The vulnerability is tracked under CWE-89, Improper Neutralization of Special Elements used in an SQL Command. The Patchstack advisory classifies the issue as a scope-changing flaw with high confidentiality impact and low availability impact.

Critical Impact
Unauthenticated attackers can extract sensitive database contents — including user credentials, session tokens, and configuration data — from any WordPress site running a vulnerable GPTranslate installation.

Affected Products

GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin versions <= 2.32.6
WordPress sites with the GPTranslate plugin installed and activated
Multilingual WordPress deployments that rely on GPTranslate for automated translation

Discovery Timeline

2026-06-15 - CVE-2026-49776 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49776

Vulnerability Analysis

The GPTranslate plugin fails to properly sanitize or parameterize user-supplied input before incorporating it into SQL queries. An unauthenticated request reaches a database query path where attacker-controlled values are concatenated directly into the statement. This permits arbitrary SQL fragments to be appended or modified by the attacker.

Because the vulnerable code path is reachable without authentication, attackers do not need a valid WordPress account. The scope-change characteristic of this issue indicates that exploitation can affect data beyond the plugin's own tables, including the broader WordPress wp_users and wp_options tables.

The EPSS probability is currently low, but unauthenticated SQL injection in WordPress plugins is routinely weaponized by mass-scanning botnets shortly after public disclosure.

Root Cause

The root cause is improper neutralization of special characters in SQL commands (CWE-89). The plugin builds SQL queries using string concatenation with untrusted input rather than using prepared statements through the WordPress $wpdb->prepare() API. Missing input validation and lack of type casting on parameters allow injection of SQL metacharacters.

Attack Vector

The attack vector is network-based with low complexity and no privileges required. An attacker issues a crafted HTTP request to a vulnerable plugin endpoint, supplying a SQL payload in a parameter that is later interpolated into a database query. Typical payloads use UNION SELECT clauses to extract data from arbitrary tables or time-based blind techniques to confirm exploitability when responses are not echoed.

For technical specifics, see the Patchstack SQL Injection Advisory.

Detection Methods for CVE-2026-49776

Indicators of Compromise

HTTP requests to GPTranslate plugin endpoints containing SQL metacharacters such as ', ", UNION, SELECT, SLEEP(, or BENCHMARK(
Unexpected outbound queries against wp_users, wp_usermeta, or wp_options tables originating from the web server process
New or modified WordPress administrator accounts following anomalous plugin traffic
Web server access logs showing long, URL-encoded parameter values directed at GPTranslate endpoints

Detection Strategies

Inspect web access logs for requests targeting GPTranslate plugin paths with suspicious query parameters or POST bodies
Deploy a web application firewall (WAF) rule set that flags WordPress plugin endpoints receiving SQL syntax in user-supplied parameters
Monitor database query logs for queries containing union-based or boolean-based injection patterns
Correlate plugin version inventory with vulnerability scanner output to identify WordPress hosts running GPTranslate <= 2.32.6

Monitoring Recommendations

Enable WordPress audit logging to capture user creation, role changes, and option modifications
Forward web server and database logs to a centralized SIEM for correlation and retention
Alert on response-size anomalies for GPTranslate endpoints, which can indicate successful data extraction via UNION SELECT
Track failed and successful administrator logins from new IP addresses following plugin endpoint activity

How to Mitigate CVE-2026-49776

Immediate Actions Required

Update the GPTranslate plugin to the patched version released after 2.32.6 as published by the vendor on the WordPress plugin repository
If a patched version is not yet available in your environment, deactivate and remove the GPTranslate plugin until the update can be applied
Rotate WordPress administrator passwords, secret keys in wp-config.php, and any API tokens stored in the database
Audit the wp_users table for accounts created or modified during the exposure window

Patch Information

Review the Patchstack SQL Injection Advisory for the fixed version number and upgrade guidance. Apply the update through the WordPress admin dashboard under Plugins, or by replacing the plugin directory on disk with the patched release.

Workarounds

Block external access to GPTranslate plugin endpoints at the WAF or reverse proxy until the patch is applied
Restrict access to /wp-admin/admin-ajax.php and REST API routes used by the plugin to known IP ranges where feasible
Enable virtual patching rules from your WAF vendor that specifically target this advisory
Deactivate the plugin if it is not actively required for site functionality

bash

# Configuration example: nginx rule to block SQL metacharacters on GPTranslate endpoints
location ~* /wp-content/plugins/gptranslate/ {
    if ($args ~* "(union.*select|sleep\(|benchmark\(|--|;\s*drop)") {
        return 403;
    }
}