WPML, used on more than 1.5 million sites, had an SQL injection flaw. A Subscriber account was enough

What exactly was wrong?

CVE-2026-17509 describes an SQL injection vulnerability in the elementIds parameter. SQL injection occurs when user-supplied data reaches a database query in a way that allows its meaning to be changed. Instead of executing only the query intended by the application, the database can be forced to reveal additional information.

In this case, the problem resulted from insufficient validation of input data and a failure to prepare the SQL query correctly. The CVE record describes a time-based SQL injection attack. An attacker therefore does not immediately receive a neat table containing the database contents. Instead, they craft queries and observe server response times, using those differences to reconstruct information step by step.

The most interesting part of this flaw is not in the SQL

The SQL injection issue was combined with a second bug. According to the Wordfence description published in the CVE record, the callback responsible for authorisation did not execute correctly. As a result, administrative translation-related functions became accessible to any authenticated user, regardless of role.

The minimum privilege level listed in the CVE is Subscriber, one of the lowest standard WordPress roles. The attack did not require taking over an administrator or editor account.

That does not mean every site using WPML was an equally easy target. The attack still required a logged-in account, and not every website allows users to create accounts themselves. On sites with user registration, however, the barrier to entry was clearly lower than with a typical vulnerability requiring administrator privileges.

Versions up to and including 4.9.5 are affected

The official CVE record lists all versions of WPML Multilingual CMS up to and including 4.9.5 as vulnerable. Newer versions fall outside the scope of this vulnerability. If a site is still running 4.9.5 or an older release, the sensible minimum is to update WPML to the latest version available for that installation.

On large multilingual sites, updating WPML can be more involved than clicking a single button because the plugin is tied into translations, content types, WooCommerce and other extensions. That does not change the priority of the fix, but it is an argument for a backup and a staging test rather than postponing the update indefinitely.

More than 1.5 million sites change the scale of the issue

WPML itself says its software runs on more than 1.5 million sites. That figure does not tell us how many were using the affected versions or how many allowed users to create accounts. It does show, however, that this is not a niche add-on with only a few hundred installations.

That is why it is worth looking beyond the CVSS score of 6.5/10 and the Medium label. The technical rating takes into account, among other things, that the attack requires authentication and primarily affects confidentiality. In practice, the importance also depends on the number of deployments, how accounts are created and what information a particular WordPress installation stores.

Is the vulnerability being actively exploited?

At the time the record was published, there was no basis for claiming that a wave of attacks was underway. The CISA data attached to the CVE marks the exploitation status as “none”. That distinction matters: there is a publicly documented vulnerability and a known attack mechanism, but that is not the same as a confirmed active campaign.

The absence of known exploitation is not a reason to leave a vulnerable version in place. A public description lowers the cost of preparing an attack, while an update closes the issue without waiting for the first headline about real compromises.

WebsiteGarage’s take

This vulnerability illustrates two things well. First, WordPress security does not end with the question “can someone get into the administrator panel?”. If an ordinary account can reach functions that should be administrative, the consequences can appear somewhere completely different.

Second, the CVSS number is not automatically the business priority. A score of 6.5 looks calmer than 9.8, but for a plugin used on more than 1.5 million sites and a flaw that can expose database information, this is still an update that should not be postponed. No panic, and no stories about a mass campaign that has not been confirmed. Just check the version, update it and close the issue.