Description

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user regardless of role to access administrative translation functionalities.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-08T12:16:53.157Z",
  "pubdate": "2026-09-08T12:16:53.157Z",
  "executiveSummary": "The WPML Multilingual CMS plugin is susceptible to a time-based SQL injection vulnerability affecting versions up to and including 4.9.5.\nThe vulnerability stems from inadequate input validation and improper sanitization of the 'elementIds' parameter, combined with a failure in the authorization callback mechanism.\nThis flaw allows authenticated attackers, including those with minimal Subscriber-level privileges, to bypass intended access controls and execute arbitrary SQL queries against the underlying database.\nBy manipulating the 'elementIds' parameter, an attacker can leverage time-based inferential techniques to exfiltrate sensitive data from the WordPress database.\nThe impact is significant, as it grants unauthorized access to administrative translation functionalities and potentially exposes the entire database content, compromising the confidentiality and integrity of the site's data.",
  "technicalDetails": "The vulnerability exists within the WPML Multilingual CMS administrative translation functionality, where the 'elementIds' parameter is processed without sufficient escaping or the use of prepared statements.\nThe root cause is a dual-layered failure: first, a lack of defensive programming practices in SQL query construction, and second, a breakdown in the authorization layer that governs access to translation management routines.\nBecause the registered authorization callback fails to execute correctly, the plugin does not perform adequate privilege verification, effectively granting Subscriber-level users the ability to interact with administrative-only endpoints.\nAn attacker can exploit this by submitting crafted requests containing malicious SQL payloads within the 'elementIds' parameter. Because the application fails to properly sanitize this input or utilize parameterized queries, the database engine treats the injected SQL fragments as part of the legitimate query logic.\nThe exploitation method relies on time-based blind SQL injection. By injecting conditional statements that force the database to pause (e.g., using sleep functions), the attacker can confirm the validity of their queries based on the server's response time.\nThe attack flow follows these steps: 1) The attacker authenticates as a Subscriber to gain access to the platform. 2) The attacker navigates to the endpoint associated with translation management, which is incorrectly exposed due to the authorization bypass. 3) The attacker injects SQL syntax into the 'elementIds' parameter. 4) The backend executes the injected query, allowing the attacker to infer data bit-by-bit by observing time delays in HTTP responses.\nPost-exploitation, the attacker can extract sensitive information, including user credentials, configuration details, or other proprietary data stored within the WordPress database tables. The vulnerability is present in versions up to 4.9.5 and requires an active authenticated session to initiate the exploit."
}