CVE-2026-12248 describes an SQL Injection vulnerability in the WPML Multilingual CMS plugin for WordPress affecting all versions up to and including 4.9.5. The issue arises from improper neutralization of special elements in the 'sorting' parameter, allowing authenticated users with translator-level privileges or above to inject additional SQL commands into existing queries. This can lead to unauthorized disclosure of sensitive database information. The vulnerability is classified under CWE-89 and has a CVSS 3.1 base score of 6.5, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and resulting in high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch available at this time, and no known exploits in the wild have been reported.

An attacker with translator-level or higher access can exploit this vulnerability to perform SQL Injection via the 'sorting' parameter, potentially extracting sensitive information from the database. The impact is limited to confidentiality as integrity and availability are not affected. The vulnerability requires authenticated access, which reduces the attack surface but still poses a significant risk to data confidentiality within affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict translator-level access to trusted users only and monitor for suspicious activity related to the 'sorting' parameter. Avoid exposing this parameter to untrusted inputs where possible.