What’s Vulnerable › Vulnerabilities

CVE-2022-3141: Translatepress Multilinugal < 2.3.3 - Admin+ SQLi

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-19 · updated 2026-06-17
• Weakness: CWE-89

Description

The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

Affected products

• Cozmoslabs TranslatePress: before 2.3.3 — fixed in 2.3.3

How to fix

Upgrade to a fixed version: Cozmoslabs TranslatePress 2.3.3. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html
• https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514
• https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3
• http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html
• https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514
• https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3

Get alerted when CVE-2022-3141 or the next vulnerability affects your stack