Subscriber Broken Access Control in Cyr to Lat reloaded

Executive Summary

CVE-2026-65537 is a Broken Access Control vulnerability in the WordPress plugin 'Cyr to Lat reloaded – transliteration of links and file names' affecting versions 1.3.3 and earlier. The issue allows unprivileged users to perform higher-privileged actions due to missing authorization, authentication, or nonce token checks.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the Cyr to Lat reloaded plugin in your WordPress site. If it is version 1.3.3 or earlier, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to verify the plugin version.

Useful 0 Not Useful 0

Impact Analysis

An attacker with low privileges could exploit this flaw to perform actions they are not authorized to do, potentially leading to unauthorized modifications or data access. However, the vulnerability is considered low severity and unlikely to be exploited in mass campaigns.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability is a Broken Access Control issue in a WordPress plugin, allowing unprivileged users to perform higher-privileged actions. While it does not directly impact GDPR or HIPAA compliance, improper access control could lead to unauthorized data access or modification, which may violate these regulations if sensitive data is exposed or altered.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Cyr to Lat reloaded plugin to version 1.3.4 or later. If auto-updates are enabled via Patchstack, ensure they are active. Remove or disable the plugin if updating is not possible.

Useful 0 Not Useful 0