CVE-2025-9451: 
WordPress vulnerability analysis and mitigation

CVE-2025-9451 is a time-based SQL Injection vulnerability in the Smartcat Translator for WPML plugin for WordPress, affecting all versions up to and including 3.1.72. The flaw arises from insufficient escaping of the orderby parameter and inadequate SQL query preparation, allowing authenticated attackers with Author-level access or higher to extract sensitive data from the database. It was published on September 11, 2025, with a CVSS v3.1 base score of 6.5 (Medium) (Red Hat CVE, Wordfence).

The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The vulnerability exists in TranslationRequestFinder.php at line 30, where the orderby parameter is passed into an SQL query without proper escaping or parameterization, enabling time-based blind SQL injection. An attacker with at least Author-level WordPress credentials can craft malicious orderby values to append additional SQL logic and infer database contents through timing differences in server responses (Wordfence, WordPress Plugin Trac).

Successful exploitation allows an authenticated attacker to extract sensitive information from the WordPress database, including user credentials, personal data, API keys, and other confidential content stored in the database. The impact is limited to confidentiality — integrity and availability are not directly affected by this vulnerability. However, extracted credentials or tokens could enable further account takeover or lateral movement within the WordPress environment (Red Hat CVE, Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-9451 as of the available data. The EPSS score is approximately 0.024%, indicating a low probability of near-term exploitation. The vulnerability requires authenticated access at the Author level or above, which limits the attack surface compared to unauthenticated vulnerabilities. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the Smartcat Translator for WPML plugin (versions ≤ 3.1.72) using tools like WPScan or by inspecting plugin directories.
2. Obtain Author-level credentials: Acquire valid WordPress credentials with at least Author-level access through phishing, credential stuffing, or other means.
3. Authenticate: Log in to the WordPress instance with the obtained credentials.
4. Craft malicious request: Send an authenticated HTTP request to the vulnerable endpoint that uses the orderby parameter, injecting a time-based SQL payload (e.g., orderby=IF(1=1,SLEEP(5),0)) to confirm the injection point.
5. Extract data: Use automated tools such as sqlmap with session cookies to enumerate database tables, extract user hashes, or retrieve other sensitive data via time-based blind SQL injection techniques (Wordfence, WordPress Plugin Trac).

• Network: Unusual or repeated HTTP requests to WordPress endpoints associated with the Smartcat WPML plugin containing orderby parameters with SQL syntax (e.g., SLEEP, IF, BENCHMARK, WAITFOR DELAY).
• Logs: WordPress or web server access logs showing requests with abnormal orderby values, particularly those causing delayed responses (indicative of time-based injection); repeated requests from the same authenticated session with varying payloads.
• Database: Unexpected or anomalous query patterns in MySQL slow query logs involving SLEEP() or conditional time-delay functions originating from the plugin's query context.

Users should update the Smartcat Translator for WPML plugin to version 3.1.73 or later, which addresses the insufficient escaping and SQL query preparation issues. As an interim measure, site administrators can restrict Author-level user permissions or temporarily deactivate the plugin if an update cannot be applied immediately. Enforcing the principle of least privilege for WordPress user roles is also recommended to reduce the attack surface (Wordfence, WordPress Plugin Page).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability report for September 8–14, 2025, noting it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence Blog). No significant broader media coverage or notable researcher commentary beyond the Wordfence disclosure has been identified.