CVE-2026-49776 AKAOMA CVE VULNERABILITIES / 12h Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

Back cve.akaoma.com

CVE-2026-49776 AKAOMA CVE VULNERABILITIES / 12h Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

cve.akaoma.com • June 16, 2026

Share: View original

9.3 /10 Critical Risk As a catastrophic security flaw, CVE-2026-49776 has severe implications, demanding immediate intervention.

As a catastrophic security flaw, CVE-2026-49776 has severe implications, demanding immediate intervention.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical SQL Injection Vulnerability in GPTranslate Plugin (CVE-2026-49776) A critical unauthenticated SQL injection vulnerability (CVE-2026-49776) has been identified in the GPTranslate plugin for WordPress, affecting versions 2.32.6 and earlier. This flaw allows attackers to execute arbitrary SQL queries through user-controlled input, potentially exposing sensitive data such as usernames and password hashes. Currently, there is no evidence of public exploitation or proof-of-concept code. A patch has been released, and users are advised to update to version 2.32.7 or later immediately. If updates cannot be applied, disabling or removing the plugin is recommended. The vulnerability has been assigned a CVSS score of 9.3, indicating its critical nature. Security professionals are urged to implement Web Application Firewall (WAF) rules to mitigate potential SQL injection attempts targeting the plugin. 3 sources 80

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Cwe-89 - SQL Injection

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application

Platforms (2)

GPTranslate WordPress