WPML String Translation < 3.2.6 – Admin+ SQLi | Plugin Vulnerabilities

Description

The context parameter on the String Translation admin page is passed directly into SQL queries without being properly sanitized, allowing SQL injection.

Proof of Concept

Visit:

.../wp-admin/admin.php?page=wpml-string-translation%2Fmenu%2Fstring-translation.php&context=Test%26%23039%3Bing

to see a database error generated due to the unescaped apostrophe. This is present in the Debug Log.

`AND s.context = 'Test'ing' AND TRIM(s.value) ...`

Affects Plugins

wpml-string-translation

Fixed in 3.2.6

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Stephen

Submitter

Stephen

Verified

Yes

WPVDB ID

2e4aa0c3-82a2-45ab-932c-415bd82d28e0

Timeline

Publicly Published

2023-07-24 (about 2 years ago)

Added

2023-07-24 (about 2 years ago)

Last Updated

2023-08-01 (about 2 years ago)

Other

Published

Title

Published

2024-07-11

Title

Barcode Scanner with Inventory & Order Manager < 1.6.2 - Authenticated (Subscriber+) SQL Injection

Published

2014-08-01

Title

Wordpress <= 2.0.6 wp-trackback.php Remote SQL Injection Exploit

Published

2025-08-28

Title

iATS Online Forms <= 1.2 - Authenticated (Contributor+) SQL Injection via order Parameter

Published

2014-08-01

Title

Facebook Opengraph Meta <= 1.0 - SQL Injection

Published

2025-01-07

Title

Google Maps Travel Route <= 1.3.1 - Authenticated (Subscriber+) SQL Injection