CVE-2015-2314

High

Published: 17/03/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

SQL injection vulnerability in the WPML plugin before version 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed.

Risk Assessment

Attackers can gain access to the database, potentially leading to data theft or system compromise.

Recommendation

It is recommended to update the WPML plugin to version 3.1.9 or later to mitigate this vulnerability.

Other vulnerabilities in WPML plugin for WordPress

CVE-2015-2792High
The WPML plugin before version 3.1.9 for WordPress does not properly handle multiple actions in a request, allowing remote attackers to bypass nonce checks and perform arbitrary actions.

Original NVD description (English source)

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the lang parameter in the HTTP Referer header in a wp-link-ajax action to comments/feed.