CVE-2026-17509: WPML Multilingual CMS <= 4.9.5 - Incorrect Authorization to Authenticated (Subscriber+) SQL Injection via ‘elementIds’
The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user regardless of role to access administrative translation functionalities.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WPML Multilingual CMS plugin for WordPressto a version that resolves this vulnerability.Fixed in 4.9.5 - Compensating control
Mitigate the issue by preventing all non-administrator authenticated users (Subscriber and above) from accessing WPML administrative translation functionalities until the plugin is upgraded/fixed, to address the authorization bypass.
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The affected authorization callback does not execute, allowing authenticated users to reach administrative translation functionality regardless of their assigned role.
What does an attacker need to do to exploit it?
The attacker needs a valid authenticated WordPress account and must submit a crafted elementIds parameter. Exploitation does not require user interaction and can be performed remotely.
What information could be exposed?
The SQL injection can be used to extract sensitive information from the WordPress database. The available data indicates confidentiality impact is high, while integrity and availability impact are not indicated.
How can I determine whether my site is affected?
Sites running WPML Multilingual CMS version 4.9.5 or earlier are affected according to the provided information. Review the installed WPML plugin version and investigate authenticated requests to translation-related administrative functionality that include unusual elementIds parameter values.