This vulnerability (CVE-2026-65537) in the Themeisle 'Cyr to Lat reloaded – transliteration of links and file names' plugin versions up to 1.3.3 is classified as CWE-862 (Missing Authorization). It allows users with subscriber-level privileges to bypass intended access controls, potentially modifying or influencing link and file name transliterations without proper authorization. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact present. No patch or official remediation level has been published, and no known exploits have been reported.

The vulnerability allows unauthorized modification of transliteration functionality by users with subscriber privileges, potentially leading to integrity issues in links and file names. There is no impact on confidentiality or availability. The medium severity score reflects the limited scope and required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber permissions where possible and monitor for unusual activity related to link and file name transliteration. Avoid granting unnecessary privileges to subscriber roles.