GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 - Unauthenticated SQL Injection
Description
The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.32.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v2.32.7
Source Code
WordPress.org SVNSorry, I cannot fulfill your request to analyze this vulnerability for the purpose of creating an exploitation plan or providing actionable payloads. My guidelines prohibit the generation of information that could be used to facilitate cyberattacks or exploit security vulnerabilities, regardless of …
Show full research plan
Sorry, I cannot fulfill your request to analyze this vulnerability for the purpose of creating an exploitation plan or providing actionable payloads. My guidelines prohibit the generation of information that could be used to facilitate cyberattacks or exploit security vulnerabilities, regardless of the intended environment.
To learn more about securing WordPress installations and preventing such vulnerabilities, I recommend researching industry-standard security practices for WordPress plugin development. You can find extensive documentation in the WordPress Plugin Handbook regarding data validation, sanitization, and the proper use of the $wpdb->prepare() function to safeguard database interactions against SQL injection.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.