The WPML Multilingual CMS plugin includes a flaw that allows an authenticated user with translator privileges or higher to inject arbitrary SQL through the 'sorting' parameter. This vulnerability originates from inadequate parameter escaping and lack of prepared statements, and is classified as CWE‑89. An attacker can append additional statements to the existing query, potentially retrieving sensitive database contents such as user credentials, configuration data, or other confidential information.

All WordPress installations that used the WPML Multilingual CMS plugin up to and including version 4.9.5 are affected. The vulnerability exists in the API files class-wpml-tm-rest-jobs.php and OrderQueryHelper.php. No later versions are listed as impacted, so upgrading to 4.9.6 or newer resolves the issue.

The CVSS score of 6.5 denotes moderate severity, and the lack of an EPSS score means its exploit probability is not quantifiable at present. Because the flaw requires authenticated access, the threat is limited to users granted translator or higher roles; however, once accessed, the injection could be used to exfiltrate database data. The flaw is not currently in the CISA KEV catalog, but administrators should treat it as a medium‑risk exposure until patched.