SQL Injection Vulnerability in WPML Multilingual CMS Plugin for WordPress

CVE-2026-17509

What is CVE-2026-17509?

The WPML Multilingual CMS plugin for WordPress allows authenticated users to exploit a time-based SQL Injection vulnerability through the 'elementIds' parameter. Due to insufficient input escaping and lack of secure SQL query preparation, attackers with Subscriber-level credentials can inject additional SQL queries into existing ones. This exploitation stems from an authorization bypass, where the expected authorization callback fails to execute, granting any authenticated user unrestricted access to administrative translation features, potentially exposing sensitive database information.

References