What’s Vulnerable › Vulnerabilities

CVE-2015-2792

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2015-03-30 · updated 2026-06-17
• Weakness: CWE-284

Description

The WPML plugin before 3.1.9 for WordPress does not properly handle multiple actions in a request, which allows remote attackers to bypass nonce checks and perform arbitrary actions via a request containing an action POST parameter, an action GET parameter, and a valid nonce for the action GET parameter.

Affected products

• OnTheGoSystems Ltd. WPML Multilingual CMS (WordPress plugin): through 3.1.8

References

• http://klikki.fi/adv/wpml.html
• http://packetstormsecurity.com/files/130839/WordPress-WPML-Missing-Authentication.html
• http://seclists.org/fulldisclosure/2015/Mar/79
• http://wpml.org/2015/03/wpml-security-update-bug-and-fix/
• http://klikki.fi/adv/wpml.html
• http://packetstormsecurity.com/files/130839/WordPress-WPML-Missing-Authentication.html
• http://seclists.org/fulldisclosure/2015/Mar/79
• http://wpml.org/2015/03/wpml-security-update-bug-and-fix/

Get alerted when CVE-2015-2792 or the next vulnerability affects your stack