WPML Multilingual CMS EUVD-2026-72698

Exploitation requires a valid WordPress account of any role, including Subscriber (the lowest default role). The authorization bypass is the key enabling condition: the plugin's capability check callback fails to execute, so no elevated role is needed beyond basic authentication. WordPress user registration must be enabled on the target site (the default is configurable by the admin). Sites with user registration disabled have a significantly reduced attack surface, as an attacker would need to obtain credentials through another means. The injection targets a specific parameter ('elementIds') within WPML's translation management functionality, so the WPML plugin must be installed and active. No specific non-default WPML configuration is required beyond installation of a vulnerable version (≤4.9.5).

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, score 6.5) accurately captures the risk profile: network-reachable, low complexity, but gated behind any form of authentication (Subscriber). The authorization bypass is the critical enabler - without it, the SQL injection would require a higher-privileged role with access to translation management. With it, any registered WordPress user (e.g., newsletter subscribers, commenters with accounts) can trigger the injection. The time-based nature slows exploitation but does not prevent it; automated tooling such as sqlmap can extract full database contents given sufficient time. Confidentiality impact is high (full DB read), while integrity and availability are not directly affected by this injection type. No EPSS data was provided, and CISA KEV status is not confirmed. Given WPML's large install base (millions of sites), the low authentication bar, and the completeness of the authorization bypass, this should be treated as a high-priority remediation item for any site with user registration enabled.

An attacker registers a free account on a target WordPress site (Subscriber role) and sends crafted POST requests to the WPML translation management endpoint with a time-delay SQL payload injected into the 'elementIds' parameter. Because the authorization callback fails silently, the request is processed without privilege checks. The attacker uses time-based inference (e.g., SLEEP() conditionals) to systematically enumerate and extract database contents - including WordPress user credentials, email addresses, and any sensitive plugin data - without direct query output.