Skip to content
Sign in
Not rated

CVE-2022-3141 The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection

Description

The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

Affected products and versions

Product Affected versions Fixed in
Translate Multilingual sites – TranslatePress 2.3 earliest → < 2.3.3 2.3.3

Other CVEs of Translate Multilingual sites – TranslatePress

The 2 CVEs of Translate Multilingual sites – TranslatePress →
CVE-2021-24610 The TranslatePress WordPress plugin before 2.0.9 does not implement a proper sanitisation on the translated strings Not rated
Track this CVE