The Ukr-To-Lat WordPress plugin through version 1.3.5 fails to sanitize a term name before incorporating it into a SQL query, enabling a SQL injection attack. Users with Contributor-level access or higher can supply crafted input that is directly embedded in the query, allowing them to execute arbitrary SQL statements. The consequences include unauthorized data access, modification, or deletion, and in some configurations could lead to remote code execution if the database is leveraged to execute stored procedures or other executable payloads.

Ukr-To-Lat WordPress plugin versions up to and including 1.3.5 are affected. No vendor identification is available, but the issue resides within the plugin code distributed for WordPress sites.

The vulnerability is exploitable by authenticated users with Contributor or higher privileges, requiring only the ability to submit a term name in the WordPress administration interface. While the exploit vector is not remote from an external attacker’s perspective, the ability to inject SQL poses a high risk to data confidentiality and integrity. The CVSS score is 6.8, indicating moderate severity, and the EPSS score is <1%; the issue is not listed in the CISA KEV catalog. The attack requires minimal effort once authentication is achieved and can target any site running a vulnerable instance of the plugin.