Translatepress Multilinugal < 2.3.3 - Admin+ SQLi
Description
The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <2.3.3
Patches
Vulnerability mechanics
Root cause
"The plugin fails to properly sanitize user-supplied input when adding new languages, allowing for SQL injection."
Attack vector
An authenticated user can exploit this vulnerability by adding a new language to the plugin's settings page. The input for the language, specifically special characters, is not properly escaped before being included in an SQL query. This allows an attacker to inject a time-based blind SQL payload, as demonstrated by sqlmap [ref_id=1]. The vulnerability is triggered via the `trp_settings[translation-languages][]` parameter during an update action on the options-general.php page [ref_id=1].
Affected code
The vulnerability lies within the Translatepress Multilingual WordPress plugin, specifically in the handling of language settings. The exploit targets the `trp_settings[translation-languages][]` parameter, which is processed when updating general options related to translation languages [ref_id=1].
What the fix does
The patch is not explicitly detailed in the provided information. However, the advisory indicates that the vulnerability is resolved in version 2.3.3. Remediation guidance suggests updating the plugin to this version or a later one to mitigate the SQL injection risk.
Preconditions
- authThe attacker must be authenticated to the WordPress instance.
- configThe 'en_us_en_gb' dictionary table must exist, which may require adding 'en_US' and 'en_GB' languages first.
Reproduction
1. Install the Translatepress Multilingual plugin (version < 2.3.3). 2. Log in to WordPress as an authenticated user. 3. Navigate to the plugin's settings page (/wp-admin/options-general.php?page=translate-press). 4. Use a tool like Burp Suite to intercept the request when adding a new language. 5. Modify the `trp_settings[translation-languages][]` parameter to include a SQL injection payload. 6. Send the modified request and observe the database response, potentially using a tool like sqlmap with the provided second request [ref_id=1].
Generated on Jun 4, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.