SA-CONTRIB-2026-310: SQL Injection

Q: Who can exploit this vulnerability?

An attacker must be authenticated and have the TMGMT-provided Create translation jobs permission. Users without that permission are not described as able to exploit it.

Q: What information could be exposed if exploitation succeeds?

The SQL injection can be used to read data from the Drupal database, including user account data.

Q: What should administrators review while remediation is pending?

Review which authenticated users or roles have the Create translation jobs permission, since that permission is required for exploitation. Restrict it to trusted users where possible.

Published Nov 4, 2026

Updated

The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data. The vulnerability is mitigated by the fact that an attacker must be logged in and hold the Create translation jobs permission provided by TMGMT.

Credit

Drew Webber (mcdruid)(the Drupal Security Team)

Affected Software

1 affected componentFixes available

composer/drupal/wordsonline_connector<2.0.6

2.0.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/drupal/wordsonline_connector to a version that resolves this vulnerability.
Fixed in 2.0.6

Event History

Nov 4, 2026

Advisory Published

via Drupal·12:00 AM

Data Sourced

via Drupal·12:00 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122084

Frequently Asked Questions

Who can exploit this vulnerability?

An attacker must be authenticated and have the TMGMT-provided Create translation jobs permission. Users without that permission are not described as able to exploit it.

What information could be exposed if exploitation succeeds?

The SQL injection can be used to read data from the Drupal database, including user account data.

What should administrators review while remediation is pending?

Review which authenticated users or roles have the Create translation jobs permission, since that permission is required for exploitation. Restrict it to trusted users where possible.

SA-CONTRIB-2026-310: SQL Injection

Credit

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this vulnerability?

What information could be exposed if exploitation succeeds?

What should administrators review while remediation is pending?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What information could be exposed if exploitation succeeds?

What should administrators review while remediation is pending?