Description

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with translator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-15T12:16:31.713Z",
  "pubdate": "2026-08-15T12:16:31.713Z",
  "executiveSummary": "The WPML Multilingual CMS plugin for WordPress is susceptible to a SQL Injection vulnerability affecting all versions up to, and including, 4.9.5. This security flaw stems from inadequate sanitization and escaping of user-supplied input combined with insufficient query preparation within the underlying database interaction routines.\nThe vulnerability allows authenticated attackers possessing translator-level access privileges or higher to manipulate the sorting parameter. By injecting malicious payloads into this parameter, adversaries can append arbitrary SQL commands to existing database queries executed by the application.\nSuccessful exploitation of this flaw grants unauthorized actors the ability to extract sensitive information stored within the underlying database, potentially compromising the confidentiality of the entire WordPress installation and exposing critical data assets.\nThe risk implication is significant due to the potential disclosure of confidential system and user data, requiring targeted remediation to ensure robust parameter handling and query parameterization across the affected software components.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure handling of the 'sorting' parameter within the WPML Multilingual CMS plugin. The application fails to apply proper input validation, contextual escaping, and parameterized query construction, leaving the database query susceptible to structure alteration via user input.\nThe vulnerable component is invoked when processing sorting logic in database queries where the 'sorting' parameter is directly concatenated or insufficiently sanitized before execution. Because the application fails to use prepared statements for this specific parameter, arbitrary SQL syntax can be injected directly into the execution context.\nExploitation requires authenticated access with translator-level privileges or above, meaning an attacker must first obtain a valid user session possessing these specific roles. Network exposure is inherent to web application access, as requests containing the malicious parameter are processed over standard HTTP/HTTPS channels by the WordPress instance.\nThe attack flow proceeds in a sequential manner. First, the authenticated attacker crafts an HTTP request containing a malicious SQL injection payload embedded within the 'sorting' parameter. Second, the vulnerable WPML Multilingual CMS plugin receives the user-supplied input without performing adequate escaping or utilizing parameterized statements. Third, the application interpolates the tainted input directly into the existing SQL query structure. Fourth, the database engine executes the modified query, allowing the attacker to execute secondary SQL commands within the context of the database user. Finally, the response from the database containing extracted sensitive information is processed and potentially reflected back or leveraged to exfiltrate data.\nThe post-exploitation impact includes unauthorized data exfiltration, enabling attackers to retrieve sensitive database contents such as user credentials, configuration settings, and confidential multilingual content managed by the plugin."
}