The Smartcat Translator for WPML plugin is vulnerable to time‑based SQL injection via the ‘orderby’ parameter. All releases up to and including 3.1.72 allow an authenticated user with Author or higher privileges to append arbitrary SQL to the existing query because the parameter is not properly escaped or bound. The vulnerability is a classic CWE‑89 flaw that can be used to read sensitive database information, such as user credentials, content, or configuration data, thereby compromising confidentiality. The impact is limited to a single authenticating web user who has sufficient role privileges; however, the attacker can obtain arbitrary data from the database, potentially leading to broader compromise if credentials are exposed.

The flaw affects the Smartcat Translator for WPML plugin in all versions up through 3.1.72. Smartcatai is the vendor, and the product is Smartcat Translator for WPML. No specific patch version is listed in the original data, so any release after 3.1.72 is likely to contain the fix.

The CVSS score is 6.5, which represents a moderate risk level. The EPSS score is less than 1 %, indicating a very low probability that the flaw is actively exploited in the wild. The vulnerability is not present in the CISA KEV catalog, so it is not known to have been widely exploited yet. Attackers must first authenticate and have at least Author role; once authenticated, they can craft a URL or form request that includes a malicious ‘orderby’ value and cause the application to execute a malicious SQL statement, extracting data from the database. The absence of an error message or other indicator in the plugin means that exploitation is stealthy unless the attacker captures the response.