EUVD-2026-59608
GHSA-5h67-368c-x3f7
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-accessible REST endpoint requires translator-level authentication (PR:L); read-only SQL injection yields high confidentiality loss with no integrity or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with translator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
AnalysisAI
SQL Injection in WPML Multilingual CMS for WordPress allows authenticated attackers holding translator-level access or above to extract sensitive information from the underlying database on all plugin versions through 4.9.5. The vulnerable code resides in the Translation Manager REST API's job-ordering logic - specifically the unsanitized 'sorting' parameter processed by OrderQueryHelper - where user-supplied input is appended to existing SQL queries without adequate escaping or prepared-statement protections. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the translator role is routinely provisioned on multilingual WordPress sites, making the authenticated barrier lower than it may appear from the CVSS score alone.
Technical ContextAI
The vulnerability is an instance of CWE-89 (Improper Neutralization of Special Elements used in an SQL Command - SQL Injection). The affected plugin, sitepress-multilingual-cms, is a commercial WordPress multilingual management solution. Two specific source files are identified in the NVD references: classes/API/REST/class-wpml-tm-rest-jobs.php at line 144 (the REST endpoint handler) and classes/jobs/query/OrderQueryHelper.php at line 34 (the query construction helper). WordPress plugins are expected to use $wpdb->prepare() for parameterized query construction, but this implementation fails to sufficiently escape or prepare the 'sorting' parameter before incorporating it into an existing SQL query, enabling additional SQL clauses to be appended. The CVSS vector AV:N/PR:L reflects that the vulnerable endpoint is accessible over the network via the WordPress REST API and requires only translator-level credentials. The scope is unscoped (S:U) and the impact is confined to confidentiality (C:H), consistent with a read-only SQL injection such as UNION-based or blind data extraction.
RemediationAI
Update WPML Multilingual CMS to a version beyond 4.9.5; verify the specific fixed version by consulting the official changelog at https://wpml.org/category/changelog/, as no explicit patched version number was named in the source data - the changelog reference suggests a fix has been or will be published. If immediate update is not possible, audit and reduce the number of active translator-level accounts to the minimum operationally necessary, and review access logs for unexpected REST API requests to the translation jobs endpoint. Disabling the WPML Translation Manager REST API endpoint can serve as a compensating control but will break WPML's translation job workflow for remote translators - weigh this trade-off against exposure window. Wordfence customers can additionally consult the Wordfence threat intelligence entry for firewall rule coverage details.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today