CVE-2025-9451

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9451", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-25T14:10:58.778Z", "datePublished": "2025-09-11T07:24:59.052Z", "dateUpdated": "2026-04-08T17:21:59.922Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:59.922Z"}, "affected": [{"vendor": "smartcatai", "product": "Smartcat Translator for WPML", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.72", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018orderby\u2019 parameter in all versions up to, and including, 3.1.72 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "Smartcat Translator for WPML <= 3.1.72 - Authenticated (Author+) SQL Injection via orderby Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebc817-ccae-4ad2-8eea-eade1c2a1a0c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/smartcat-wpml/trunk/includes/Services/App/Includes/TranslationRequestFinder.php#L30"}, {"url": "https://wordpress.org/plugins/smartcat-wpml/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3368366/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "timeline": [{"time": "2025-09-10T18:45:26.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T13:41:48.181571Z", "id": "CVE-2025-9451", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:38:07.093Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-11T13:41:48.181571Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T13:44:16.665Z"}}], "cna": {"title": "Smartcat Translator for WPML <= 3.1.72 - Authenticated (Author+) SQL Injection via orderby Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Peter Thaleikis"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "smartcatai", "product": "Smartcat Translator for WPML", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.1.72"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:45:26.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebc817-ccae-4ad2-8eea-eade1c2a1a0c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/smartcat-wpml/trunk/includes/Services/App/Includes/TranslationRequestFinder.php#L30"}, {"url": "https://wordpress.org/plugins/smartcat-wpml/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3368366/"}], "descriptions": [{"lang": "en", "value": "The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018orderby\u2019 parameter in all versions up to, and including, 3.1.72 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:59.922Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9451", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:59.922Z", "dateReserved": "2025-08-25T14:10:58.778Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:59.052Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Smartcat Translator for WPML", "vendor": "smartcatai", "versions": [{"lessThanOrEqual": "3.1.72", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Smartcat Translator for WPML plugin for WordPress is vulnerable to time-based SQL Injection via the \u2018orderby\u2019 parameter in all versions up to, and including, 3.1.72 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "id": "CVE-2025-9451", "lastModified": "2026-06-17T10:09:01.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9451", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T13:41:48.181571Z", "version": "2.0.3"}}]}, "published": "2025-09-11T08:15:36.743", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/smartcat-wpml/trunk/includes/Services/App/Includes/TranslationRequestFinder.php#L30"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3368366/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/smartcat-wpml/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c9ebc817-ccae-4ad2-8eea-eade1c2a1a0c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:37:55.922913+00:00", "value": {"mitigation_remediation": ["Upgrade the Smartcat Translator for WPML plugin to the latest version (3.1.73 or newer) that removes the vulnerable \u2018orderby\u2019 handling.", "Until an update can be applied, restrict Author or higher role users from accessing the plugin\u2019s language settings or disable the WPML functionality for those roles to prevent exploitation.", "Apply a temporary workaround by sanitizing or validating the \u2018orderby\u2019 parameter on the server side to allow only a whitelist of expected values before passing it to the database, ensuring it is not concatenated into the SQL query.", "Continuously monitor database logs and account activity for unusual query patterns or unauthorized data access following an update."], "summary": {"action": "Apply Patch", "impact": "Authenticated SQL Injection"}, "threat_synthesis": {"affected_systems": "The flaw affects the Smartcat Translator for WPML plugin in all versions up through 3.1.72. Smartcatai is the vendor, and the product is Smartcat Translator for WPML. No specific patch version is listed in the original data, so any release after 3.1.72 is likely to contain the fix.", "description_and_impact": "The Smartcat Translator for WPML plugin is vulnerable to time\u2011based SQL injection via the \u2018orderby\u2019 parameter. All releases up to and including 3.1.72 allow an authenticated user with Author or higher privileges to append arbitrary SQL to the existing query because the parameter is not properly escaped or bound. The vulnerability is a classic CWE\u201189 flaw that can be used to read sensitive database information, such as user credentials, content, or configuration data, thereby compromising confidentiality. The impact is limited to a single authenticating web user who has sufficient role privileges; however, the attacker can obtain arbitrary data from the database, potentially leading to broader compromise if credentials are exposed.", "risk_and_exploitability": "The CVSS score is 6.5, which represents a moderate risk level. The EPSS score is less than 1\u202f%, indicating a very low probability that the flaw is actively exploited in the wild. The vulnerability is not present in the CISA KEV catalog, so it is not known to have been widely exploited yet. Attackers must first authenticate and have at least Author role; once authenticated, they can craft a URL or form request that includes a malicious \u2018orderby\u2019 value and cause the application to execute a malicious SQL statement, extracting data from the database. The absence of an error message or other indicator in the plugin means that exploitation is stealthy unless the attacker captures the response."}}}}, "created": "2025-09-12T09:11:22.038663+00:00", "updated": "2026-04-20T19:45:15.507124+00:00", "vendors": ["smartcatai", "smartcatai$PRODUCT$smartcat_translator_for_wpml_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}