Critical SQL Injection Vulnerability in GPTranslate Plugin (CVE-2026-49776)

A critical unauthenticated SQL injection (CVE-2026-49776, CVSS 9.3) was found in the GPTranslate WordPress plugin (≤2.32.6) that can allow attackers to run arbitrary SQL queries and potentially expose usernames and password hashes; a patch (2.32.7) is available and administrators are urged to update or remove the plugin and apply WAF mitigations. No public exploitation or proof-of-concept has been observed.