CVE-2026-12248

The WPML Multilingual CMS plugin for WordPress contains a vulnerability that allows attackers with translator-level access to inject malicious SQL code into the plugin's database queries. This occurs because the plugin does not properly sanitize user input in the 'sorting' parameter, which can be exploited to extract sensitive information from the database. As a result, authenticated attackers can append additional SQL queries to existing ones, potentially leading to unauthorized data exposure.

Based on public CVE data (MITRE/NVD).