Executive brief
WPML Multilingual CMS is a widely-used WordPress plugin that enables websites to serve content in multiple languages. The plugin contains a SQL injection vulnerability in versions up to 4.9.5 that allows authenticated users with low-privilege accounts (even basic Subscriber role) to query and extract sensitive data from the website's database. An authorization bypass further amplifies the risk by allowing any logged-in user to access administrative translation features they should not have permission to use.
Technical details
The vulnerability is a time-based SQL injection flaw in the 'elementIds' parameter caused by insufficient input escaping and improper SQL query preparation. The affected component handles translation functionality within WPML's administrative interface. An authenticated attacker with Subscriber-level access or higher can exploit this to append arbitrary SQL queries and extract sensitive database information. Additionally, a broken authorization callback allows any authenticated user to bypass role-based access controls and reach administrative translation endpoints. The vulnerability affects all versions up to and including 4.9.5; patched versions are not yet documented in the provided reference material.
Affected products
- OnTheGoSystems WPML Multilingual CMS up to and including 4.9.5
Timeline
- 2026-09-08: disclosed