CVE-2025-9451 Overview
CVE-2025-9451 is a time-based SQL Injection vulnerability in the Smartcat Translator for WPML plugin for WordPress. The flaw affects all versions up to and including 3.1.72. It stems from insufficient escaping of the orderby parameter and inadequate preparation of the underlying SQL query. Authenticated attackers with Author-level access or higher can append additional SQL statements to existing queries. Successful exploitation enables extraction of sensitive information from the WordPress database. The vulnerability is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated users with Author role or above can exfiltrate database contents, including credentials and session tokens, from affected WordPress sites.
Affected Products
- Smartcat Translator for WPML plugin for WordPress — all versions through 3.1.72
- WordPress sites running the smartcat-wpml plugin with Author-level or higher accounts
- Multisite WordPress deployments where the plugin is network-activated
Discovery Timeline
- 2025-09-11 - CVE-2025-9451 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-9451
Vulnerability Analysis
The vulnerability resides in the TranslationRequestFinder.php component of the Smartcat Translator for WPML plugin. The plugin accepts a user-controlled orderby parameter and concatenates it directly into an SQL query without proper sanitization or parameterized binding. Because WordPress $wpdb->prepare() does not safely handle column names or ORDER BY clauses by default, the raw input flows into the query string. An authenticated attacker submits a crafted orderby value containing SQL time-delay payloads such as SLEEP() or conditional sub-selects. The server response time reveals whether injected boolean conditions evaluate true, allowing blind data extraction one character at a time.
Root Cause
The root cause is improper neutralization of special elements in an SQL command [CWE-89]. The plugin trusts the orderby request parameter and omits an allow-list of valid column names. It also fails to use parameterized queries or escape identifiers through esc_sql(). See the WordPress Plugin Code Reference for the vulnerable code path.
Attack Vector
An attacker must first authenticate to the target WordPress site with at least Author privileges. The attacker then sends a request to the plugin endpoint that processes translation requests, supplying a malicious orderby value. By measuring response timing, the attacker performs blind SQL inference to enumerate tables and extract rows such as wp_users. No user interaction is required beyond the attacker's own authenticated session.
No verified public exploit code is available. See the Wordfence Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-9451
Indicators of Compromise
- HTTP requests to Smartcat plugin endpoints containing orderby values with SQL keywords such as SLEEP, BENCHMARK, SELECT, or UNION.
- Anomalous web request latency correlated with authenticated Author or Editor sessions interacting with the plugin.
- Unexpected wp_users or wp_options read patterns in MySQL general or slow query logs.
Detection Strategies
- Enable MySQL slow query logging and alert on queries containing time-delay functions originating from the WordPress database user.
- Deploy a web application firewall rule that blocks orderby parameters containing SQL meta-characters, parentheses, or whitespace sequences.
- Review WordPress audit logs for Author or Editor accounts issuing repeated plugin AJAX or REST requests within short time windows.
Monitoring Recommendations
- Correlate authentication events for low-privilege accounts with subsequent database query spikes to detect credential abuse.
- Monitor outbound traffic from the WordPress host for data exfiltration patterns following suspicious plugin requests.
- Baseline normal response times for plugin endpoints and alert on sustained deviations consistent with blind SQL injection probing.
How to Mitigate CVE-2025-9451
Immediate Actions Required
- Update the Smartcat Translator for WPML plugin to the version released in changeset 3368366 or later.
- Audit all Author, Editor, and Administrator accounts and remove unused or inactive users.
- Rotate database credentials and WordPress secret keys if exploitation is suspected.
Patch Information
The vendor addressed the issue in a plugin update tracked in changeset 3368366. Administrators should install the fixed release available on the Smartcat WPML plugin page. Verify the installed version is greater than 3.1.72 through the WordPress plugins dashboard.
Workarounds
- Deactivate the Smartcat Translator for WPML plugin until the patched version is deployed.
- Restrict Author-level and higher roles to trusted users through strong password policies and multi-factor authentication.
- Deploy a WAF ruleset that blocks SQL injection payloads in query parameters targeting the plugin's endpoints.
# Update the plugin via WP-CLI
wp plugin update smartcat-wpml
# Verify installed version
wp plugin get smartcat-wpml --field=version
# Temporary workaround: deactivate the plugin
wp plugin deactivate smartcat-wpml
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
