CVE-2026-12248 describes an SQL Injection vulnerability in the WPML Multilingual CMS plugin for WordPress. The flaw exists in the handling of the 'sorting' parameter, which is not properly escaped or prepared in SQL queries. This allows authenticated attackers with translator-level or higher privileges to inject additional SQL commands into existing queries, enabling unauthorized data extraction from the database. The vulnerability affects all versions up to and including 4.9.5. No official patch or remediation level has been confirmed as of the published date.

An attacker with translator-level or higher access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not allow privilege escalation or denial of service but compromises data confidentiality. The CVSS 3.1 base score is 6.5 (medium severity), reflecting network attack vector, low attack complexity, and limited privileges required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict translator-level access to trusted users only and monitor for suspicious activity related to the 'sorting' parameter. Avoid exposing this parameter to untrusted inputs where possible.