CVE Catalog
CVE-2015-2792
HighSummary
The WPML plugin before version 3.1.9 for WordPress does not properly handle multiple actions in a request, allowing remote attackers to bypass nonce checks and perform arbitrary actions.
Risk Assessment
Attackers can exploit this vulnerability to perform unauthorized actions on the site, potentially leading to serious security breaches.
Recommendation
It is recommended to update the WPML plugin to version 3.1.9 or later to mitigate this threat.
Other vulnerabilities in WPML plugin for WordPress
Original NVD description (English source)
The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.