HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2015-2792

CVSS 7.5v2.0pub. 2015-03-30upd. 2026-05-06

The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.

CVSS Vector
AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Wpml

    APP
    Wpml
    ≤ 3.1.8
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2024-6386CRITICAL9.9PL ✓ten sam produkt

RCE w pluginie WPML dla WordPress via Twig Server-Side Template Injection

CVE-2015-2314HIGH7.5ten sam produkt

SQL injection vulnerability in the WPML plugin before 3.1.9 for WordPress allows remote attackers to execute a...

CVE-2025-3488MEDIUM6.4ten sam produkt

The WPML plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpml_language_swit...

CVE-2022-38974MEDIUM4.3ten sam produkt

Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows user...

CVE-2022-38461MEDIUM5.4ten sam produkt

Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows user...