CVE-2026-12248

Name of the Vulnerable Software and Affected Versions WPML Multilingual CMS versions prior to 4.9.6

Description Insufficient escaping of user-supplied input and lack of proper preparation in SQL queries allow authenticated attackers with translator-level access or higher to perform SQL Injection. By manipulating the sorting parameter, an attacker can append additional SQL queries to extract sensitive information from the database.

Recommendations Update WPML Multilingual CMS to version 4.9.6 or later. Avoid using the sorting parameter until the update is applied.