The vulnerability is an unauthenticated SQL injection flaw in the WordPress Transliterator plugin versions up to 2.5.13. An attacker can supply specially crafted input that is directly reflected in a database query without proper sanitization or parameterization. This allows the execution of arbitrary SQL statements, potentially resulting in data exfiltration, modification, or deletion of critical content held in the WordPress database.

WordPress installations running the Transliterator plugin version 2.5.13 or any earlier release, provided by Ivijan-Stefan Stipic.

The CVSS score of 9.3 indicates a critical impact and the vulnerability can be exploited remotely without authentication. The EPSS score is not available, but the lack of a KEV listing does not diminish the potential for widespread attacks. The likely attack vector involves an unauthenticated request to the plugin’s endpoints, where malicious input is inserted into a SQL query.