CVE-2026-49776: WordPress GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin <= 2.32.6 - SQL Injection vulnerability

Synopsis

An unauthenticated SQL injection vulnerability affects the GPTranslate Multilingual AI Translation plugin for WordPress in versions up to and including 2.32.6. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation gives an attacker read access to the WordPress database, including user credentials, session tokens, and any stored content, and can also cause limited service disruption. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable plugin endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation to trigger the injection.

• AuthenticationNot required

  No account or session token of any privilege level is needed; the vulnerable code path is accessible to completely unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully automated and requires no action from any user of the WordPress site.

• Attack complexityDetail

  Attack complexity is low, meaning the SQL injection is reliable and requires no special environmental conditions, race timing, or memory layout knowledge to execute.

Blast Radius

• Reads arbitrary rows from the WordPress database, including wp_users password hashes, email addresses, and any stored session tokens.
• Reads data from custom tables created by other installed plugins, which may include personal information, payment references, or API keys stored in the database.
• Causes limited availability disruption through heavy or malformed SQL queries that degrade database performance or cause query failures.