CVE-2026-17509 is a time-based SQL Injection vulnerability in the WPML Multilingual CMS plugin for WordPress. The flaw exists in the 'elementIds' parameter, which is not properly escaped, allowing attackers with authenticated access (Subscriber role or higher) to append malicious SQL queries. The vulnerability is exacerbated by an authorization bypass where the registered authorization callback does not execute, permitting any authenticated user to access administrative translation features. This enables extraction of sensitive information from the database without requiring higher privileges.

An attacker with authenticated access at Subscriber level or above can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure via SQL Injection. There is no indication of privilege escalation or denial of service from the provided data.

No official patch or remediation is currently confirmed. Users should monitor the vendor's advisories for updates. Until a fix is available, restrict authenticated user roles to trusted users only and consider disabling or limiting access to the WPML Multilingual CMS plugin's translation administrative functions to mitigate risk.